340% more signups. 60% less paid revenue. One removed checkbox.

A founder on r/SaaS removed the credit-card requirement from his trial signup. Signups went up 340%. Trial-to-paid conversion went down 60%. The post has 573 upvotes, and most of the replies congratulate him.

He had followed the advice. Reduce friction. Everyone says it. It is on every CRO checklist ever written, and on his page it was wrong, because the checkbox he deleted was not only friction. It was also the thing that told him who was serious.

That is the problem I built @di-atomic/cro-audit to fix, and it is not the problem I expected to be fixing.

Best practice is survivorship bias with a case study attached

Here is what a CRO best practice actually is. Something worked on one page, for one audience, at one moment. Someone wrote it up. It got abstracted until it was general enough to repeat safely, and by then every detail that made it true was gone. What is left travels well and predicts nothing.

"Add social proof." "Make the CTA pop." "Put it above the fold." These sound authoritative. Read them again and notice that none of them say anything about your page.

I know this because the first version of my auditor produced exactly that, and it was worthless. It scored well on every internal check I had and told me nothing I could act on. Ask any general-purpose model to audit a landing page and you get the same output: a tidy list of things that are true of pages in general and unfalsifiable about yours.

Three numbers that killed the checklist for me

Social login. It lifts signup 20% to 35% on average. One SaaS measured +28%, with registration completing about 10x faster. Then a study of a B2B tool found it reduced conversions, because business users would rather type an email than connect a personal account. Same feature, opposite sign, and the deciding variable is who is looking at it.

Placement. The same trust badge has been measured anywhere from -5% to +75%. Not different badges. The same one, moved. Above the fold is genuinely where attention lives, and Nielsen Norman Group measured 57% of viewing time and 102% more views there. But below-fold CTAs can still win by around 20% when the content above them earns the scroll. So "move it up" is not advice. It is a coin flip you are calling on someone else's page.

Specificity. Social proof does not have one lift number, it has a gradient. Generic unattributed testimonials land around 2% to 5%. Named, with a photo and a specific outcome, land 15% to 25%. Video reaches 30% to 40%. "Add testimonials" collapses a 10x range into three words.

Those are three cases where following the canon costs you money. There is no version of a checklist that catches them, because the checklist is the thing causing them.

So I made the platitude a build failure

cro-audit is guidance-only. There is no backend and nothing to call. It is a discipline, an evidence library, and four scripts that grade the audit before you ever see it.

It scores eight dimensions every time: Value-Prop, CTA, Social Proof, Urgency, Trust and Security, Form Friction, Mobile, and Page Speed. verify-audit-coverage.mjs demands 8 of 8. If a dimension cannot be assessed, the audit has to say so and say why. Silence is not a pass.

Then lint-no-best-practice-platitudes.mjs reads the findings and fails the run if any of them is a platitude. And grade-evidence-density.mjs requires at least 80% of findings to name a specific element on the page and cite a real benchmark with a source.

Here is the difference those scripts enforce.

Rejected:

Add social proof to build trust.

Accepted:

Your hero has no proof above the fold. Add a testimonials block or install sys-proof-recent-sales-toast. Named testimonials with a photo and a specific outcome lift 15% to 25%, against 2% to 5% for generic unattributed ones (Digital Applied, 2026).

The second one names the element, names the fix, carries the range, and tells you who measured it. You can disagree with it. That is the point. A finding you cannot argue with is a finding that says nothing.

Findings come back ranked by ICE, which is severity times lift potential divided by effort, so the list is ordered by what to do Monday morning rather than by what is easiest to write. Most pages have one dominant leak, not ten. Underneath sit 60 evidence cards, 13 learnings, and 8 recipes for the surfaces people actually audit: landing, pricing, signup, checkout, blog, docs, homepage, and mobile.

Two rules I would keep even if I threw the rest away

Never celebrate a single-metric win. This is the r/SaaS founder's lesson, and it is now a rule the auditor cannot skip. Whenever a finding recommends removing friction, it has to name the downstream metric that could move the other way and tell you to measure both. Signups and paid. Clicks and completion. It also has to surface the alternatives that keep the filter while lowering the wall: a $1 paid trial, a money-back guarantee, freemium with real limits.

Never manufacture pressure. No fake urgency, no fake scarcity, no invented social proof. If the auditor finds any of those on your page it flags them as a risk to remove, not a win to keep. And on regulated pages, which is a lot of my work, it will not add an unqualified outcome claim to lift conversion. Under REACH, CLP, SDS and biocide rules, a claim is a legal artifact before it is a conversion lever. Existing absolute claims get flagged as exposure.

It diagnoses. It does not touch your page.

That boundary is deliberate. cro-audit reads the X-ray and names what is wrong with a citation. The fixes go somewhere else: SpiderPublish for block edits and sys-* components, @di-atomic/copy-engine for the words, @di-atomic/section-designer for the layout. A sequencing sibling, cro-actions, is next on my board and will turn a ranked finding list into a plan with owners and dates. It is not shipped yet, and I would rather say that than imply a chain I have not finished. A skill that both diagnoses and treats will always find the disease it happens to cure.

You will still have to test what it tells you. Every finding it returns is a hypothesis with a direction and a number attached, not a promise, because on your traffic it might be the one that goes the other way. That is the honest version of this job, and it is the version I wanted my own agents running.

It is live on the OPVS marketplace as @di-atomic/cro-audit, now at v0.1.2. Point it at a page and ask it what is leaking.