Ecommerce store testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a shopper finds a product, adds it to the cart, pays with a test card and receives an order confirmation email.Risks: store-rejection, money-loss. Tool class: browser automation. Usually run by: QA engineer.
2. 2.integration testsDone when: Order, payment and fulfilment status match across the storefront, payment provider and warehouse system for paid, shipped, cancelled and refunded orders.Risks: money-loss, regulatory-penalty. Tool class: API client. Usually run by: developer.
3. 3.end-to-end functional testsDone when: An order for a backordered item that passes its promised ship date triggers a delay email with a working cancel link, and cancelling issues a card refund.Risks: regulatory-penalty, money-loss. Tool class: browser automation. Usually run by: QA engineer.
4. 4.data integrity and migration testingDone when: A daily report shows every cancelled or unshipped order with a card refund, not store credit, unless the shopper chose credit.Risks: money-loss. Tool class: data validation. Usually run by: QA engineer.
5. 5.payment and money-flow testingDone when: A declined card, a 3-D Secure challenge, a partial refund and a full cancellation each leave exactly one matching entry on the test card statement and in the admin order.Risks: money-loss. Tool class: API client. Usually run by: QA engineer.
6. 6.accessibility testingDone when: A screen reader user picks a size and colour, adds the item to the cart and completes checkout with the keyboard alone.Risks: accessibility-liability. Tool class: accessibility checker. Usually run by: accessibility specialist.
7. 7.compliance checksDone when: A signed checklist shows review moderation treats one-star and five-star reviews by the same rule, and shipping-delay notices follow the mail order rule.Risks: regulatory-penalty. Tool class: test management. Usually run by: product manager.
8. 8.security scanningDone when: The checkout page loads only scripts on an approved list, a change to any of them raises an alert, and the scan shows no open high-severity finding.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
9. 9.penetration testingDone when: A tester signed in as one shopper cannot see another shopper's orders, addresses or saved cards by changing an order or customer id.Risks: data-breach. Tool class: proxy. Usually run by: security specialist.
10. 10.resilience and failure testingDone when: With the CDN switched off in staging, the storefront serves from origin or a status page, and no order is charged without being recorded.Risks: dependency-failure. Tool class: chaos tool. Usually run by: developer.