What this audit checks
Authentication & access
- API token valid + scoped (auth on /user/tokens/verify)
- Token grants Zone:Read + Zone.Analytics:Read for the configured zone
- Zone ID resolves to an active (not paused / deactivated) zone
- Origin URL reachable and returns a CrUX field record (origin has enough traffic)
Core Web Vitals (field - the rank + conversion gate)
- Mobile CWV pass rate < 50% (conversion + SEO emergency)
- Mobile LCP p75 > 4000ms (loading-speed gate failing)
- Mobile INP p75 > 500ms (responsiveness gate failing)
- Mobile CLS p75 > 0.25 (visual-stability gate failing)
- Mobile TTFB p75 > 1800ms (origin / edge response too slow)
Lighthouse lab scores (deploy-regression signal)
- Mobile performance score < 50 (poor) - flag vs prior 30D
- Desktop performance score < 50 (poor)
- Accessibility score < 70 (a11y + SEO + legal exposure)
- Best-practices score < 70 (HTTPS / console errors / deprecated APIs)
- SEO score < 70 (crawlability / meta / structured-data basics)
Page weight & edge efficiency
- Total page weight > 3MB (creeping weight behind the CDN)
- Render-blocking resources > 500ms estimated savings (edge / Workers fix)
- Total blocking time > 600ms (interactivity proxy failing)
- Speed Index > 5800ms (slow visual completeness)
Cross-platform: revenue-at-risk from slow pages (the killer area)
- Top-traffic page (sibling = google_search_console) failing CWV on this origin = compute ranking + click exposure
- Slow product / collection page (sibling = shopify / bigcommerce / adobe_commerce) where LCP > 4s - quantify conversion lift from a fix
- Origin CWV pass rate < 50% while google_analytics bounce rate trends up on the same hostname
- Lighthouse performance regression coincident with a sibling deploy / theme publish window
Severity thresholds
Data sources
GET https://api.cloudflare.com/client/v4/user/tokens/verify- Token sanity + scope checkGET https://api.cloudflare.com/client/v4/zones/{zone_id}- Zone status + plan + paused/dev-mode flagsGET https://api.cloudflare.com/client/v4/zones/{zone_id}/analytics/dashboard- Edge traffic + cache analytics contextGET https://pagespeedonline.googleapis.com/pagespeedonline/v5/runPagespeed- Lighthouse lab scores + CrUX field CWV for the origin (mobile + desktop)