A founder UX audit is a self-run check of your product’s 3 money flows (signup, first session, core loop) against named usability rules. You get 24 yes/no checks below, each tagged with the Nielsen heuristic, WCAG criterion, or Law of UX it enforces. No designer, no $10k engagement, no 40-slide deck. One afternoon.
Why you only audit 3 flows
Because before product-market fit, every single user passes through signup, the first session, and the core loop, and almost nobody goes anywhere else. A bug on your settings page hurts the handful of users who find it. A bug in signup hurts 100% of everyone you will ever acquire. Same fix effort, wildly different payoff.
The activation numbers say this is where products actually die. Lenny Rachitsky and Yuriy Timen’s survey of 500+ products put median activation barely above 1 in 4 signups. The other 3 never reach value, and that loss happens inside exactly the flows this checklist covers. The full numbers, caveats included, are in why users abandon your signup flow.
Fixing this early compounds: in the same Amplitude data, 69% of products in the top quartile at day 7 were still top performers at 3 months. A whole-product audit, meanwhile, hands you a 60-item list where item 41 is a footer link color. At your stage that is noise wearing a high-visibility vest. Scope ruthlessly: 3 flows, 24 checks. (Signup deserves its own teardown, and it has one: why users abandon signup.)
How to run the audit
Fresh browser, real phone, screen recorder on, one flow at a time: the setup takes 10 minutes and the walk takes an afternoon. The order matters less than the discipline.
- Get the cleanest eyes you can. New browser profile or incognito, logged out, autofill off. Your cookies have been hiding your own signup from you for months.
- Repeat on a real phone. Devtools emulation lies about thumbs. Your actual phone will find the 18px close button that your mouse never noticed.
- Record both passes. Loom, QuickTime, whatever. Timestamps beat memory, and clips become ticket evidence later.
- Walk in with a job, not a wander. “I run a 3-person agency and I need to send one invoice before lunch.” Type realistic data. Make deliberate mistakes: wrong password twice, back button mid-flow, double-click on submit.
- Log findings as one-liners while you walk. Where, what happened, gut severity. Do not stop to fix anything; the audit dies the first time you open your editor.
Then sit down with the checklist below and answer all 24 honestly. House rule: if you have to think about a check for more than 2 minutes, the answer is no.
The 24-point founder UX audit checklist
24 checks across signup, first session, and core flow: each one is falsifiable, answerable in about 2 minutes, and tagged with the rule it enforces. The tags come from Nielsen’s 10 usability heuristics, WCAG 2.2 (which added 9 criteria in October 2023, several tailor-made for exactly these flows), and Laws of UX. If you want to see the full heuristic method run end to end first, we did it on a fictional app that violates all 10.
The receipts behind the checks
These are not vibes; the checks with measurable stakes have published numbers behind them:
- Field count. Baymard’s checkout benchmark puts the average flow at 11.3 form fields when most sites need only 8. Your signup deserves the same scrutiny: every field is a place to lose someone.
- Forced account creation. In Baymard’s abandonment survey (updated September 2025), 19% of US shoppers who abandoned a checkout cited “the site wanted me to create an account” as a reason.
- Inline validation. Luke Wroblewski’s study with Etre measured a 22% higher success rate, 22% fewer errors, and 42% faster completion with inline validation versus validate-on-submit. Small eye-tracking study, so treat the exact numbers gently, and note its own caveat: validate when the user leaves a field, not on every keystroke.
- Contrast. WebAIM’s 2026 scan of 1 million home pages keeps finding low-contrast text as the web’s single most common accessibility failure. Assume you have it until a checker says otherwise.
Your password reset is a safety net you have never once jumped into. You are trusting your churn rate to a transactional email you last thought about at setup.
In Baymard’s testing, hitting a password reset mid-checkout cost nearly 1 in 5 orders, with reset emails delayed or in spam even at Amazon and ASOS (the exact numbers are in the signup teardown). That is why check 18 exists. Running it takes 4 minutes: incognito window, “Forgot password”, start a timer, open the email on your phone, click the link. If any step makes you wince, that wince is a ticket.
Nielsen #9 · Recover from errorsTake it with you
Prefer to score in your own tool? Here is the terse version for Notion, Linear, or a plain text file.
How to score what you found
Every failed check becomes a finding with one of 3 severities: Blocker (users fail or lose work), Major (users struggle, some give up), or Minor (friction and irritation). This maps onto NN/g’s 0 to 4 severity scale, which weighs 3 factors: how often the problem occurs, how hard it is to overcome, and whether it bites once or every time. Fix Blockers this week, Majors this sprint, and Minors when you are already touching that screen.
Write each finding so it can go straight into the backlog. Like this:
The full format, including steps to reproduce and why devs reject tickets without them, is in how to turn UX findings into tickets devs actually fix.
What this checklist cannot catch
It cannot catch the problems you have gone blind to: a checklist verifies rules, and you will pass yourself on anything ambiguous. You built this product. You know which icon opens the exporter and what “workspace” means here, so you physically cannot experience the confusion of someone who does not. Blindness from familiarity, not incompetence, and no amount of honest box-ticking cures it.
A checklist also only sees violations, never comprehension. Your signup can pass all 8 checks while the headline above it convinces people they are in the wrong place. Catching that takes eyes that have never seen the product: 5 real users on a call, or an agent that walks in cold. We compared the options in AI agents vs synthetic users vs real users. If you want the agent version, ClapBack runs exactly this kind of pass from a URL: it signs up, breaks your flows, and returns findings as tickets with a severity and a cited rule, in minutes instead of an afternoon.
Either way, run the afternoon audit first. It is free, it clears the embarrassing stuff, and it makes whatever fresh eyes you bring in later spend their time on problems only fresh eyes can find.