CRO Process: The 6 Steps From Data to a Winning Test

2. The Six Steps of the CRO Process

Quick Answer: The CRO process runs in six steps: measure what happens now, research why it happens, rank the leaks by size and effort, write a falsifiable hypothesis, read the change with a test or a fixed before-and-after window, then decide and start again. Each step produces one document the next step depends on.

The six steps are a loop, not a project. Here is what each one is supposed to produce before you move on:

1. Measure. A working count of every enquiry action — form, WhatsApp tap, call tap — split by device and traffic source.
2. Research. Recordings, scroll and click data, form field drop-off, and what people typed to arrive.
3. Rank. A written leak list, scored by how many people each problem affects and how long the fix takes.
4. Hypothesise. One sentence per change stating what you expect to move and by roughly how much.
5. Read. A split test where traffic allows, or a fixed before-and-after window where it does not.
6. Decide. Keep, revert, or retest — recorded, so the next cycle starts from evidence instead of memory.

Notice what is missing: “redesign”. A CRO process changes one thing at a time so the result stays readable. Ship five changes together and you have a new website with no idea which part earned the lift. That is the line between conversion work and a rebuild, and part of what conversion rate optimisation services include.

3. Step 1: Count What Is Happening Now

Quick Answer: Step one of the CRO process is a working baseline: every enquiry action counted in one place, split by device and source, with at least four clean weeks behind it. Roughly half the SME sites we take on are miscounting on day one, usually double-counting or missing WhatsApp taps entirely.

This step is boring and it is where most cycles quietly fail. If the numbers are wrong, every later step inherits the error, and you spend a quarter optimising a page that was never the problem.

A usable baseline needs four things:

• Every action counted. Form submits, WhatsApp taps, call taps and thank-you page views, not just the form.
• No double counting. A refresh on the thank-you page must not register a second enquiry.
• Split by device and source. One blended rate hides the mobile problem that usually is the problem.
• Four clean weeks. No campaign launches, no festive spikes, no site changes mid-window.

Decide here what counts as a conversion. Counting every newsletter signup as a win flatters the report and misleads the ranking, so it helps to define a qualified lead before you spend. The mechanics are in setting up conversion tracking in GA4 properly, and the page most sites forget to track is the thank you page. Then check your number against conversion rate benchmarks for Malaysian SMEs.

4. Step 2: Where Winning Changes Actually Come From

Quick Answer: Across ZenWeb-managed accounts, session recordings and form field data produced about half of every change that later showed a measurable lift. Ideas that came from an opinion in a meeting — nobody’s data, just a strong view — accounted for 7% of the winners and a much larger share of the failures.

The top two rows share a quality: both show a person failing, not a number describing failure. You watch someone tap a phone number that is not a link, or abandon at the field asking for a company name they do not have.

Budget research time accordingly. Twenty recordings of mobile visitors who left without enquiring teach you more than a week in the analytics dashboard. Start with what a heatmap actually shows you, then pick tooling from the best heatmap tools for Malaysian websites. What to look for is listed in our 15-point conversion audit, and form behaviour in how to stop losing people mid-form.

5. Step 3: Rank the Leaks Before You Fix Anything

Quick Answer: Step three turns research into an ordered queue. Score each leak on two numbers you can defend — how many visitors per 1,000 it affects, and how many days the fix takes — then work down the list. The ranking, not the testing, is where most of the value in a CRO process is created.

Below is a leak list from a services site with roughly 4,000 monthly visitors. The estimates are deliberately rough; the point is the order, not the decimal places.

Row five is the instructive one. It affects every single visitor, so instinct puts it first — but it costs five build days and returns the least. Speed still matters: Google treats a Largest Contentful Paint of 2.5 seconds or less as good and 4 seconds as poor, measured at the 75th percentile of loads. It simply is not the first job here.

Rows one and three both point at phones, which is the pattern nationally. With 44.0 million active cellular connections in Malaysia at the end of 2025, equal to 122% of the population, mobile is the default screen for enquiries. The fixes are covered in why phone visitors never enquire and the sticky call button most SMEs miss.

6. Step 4: Write a Hypothesis You Can Be Wrong About

Quick Answer: A usable hypothesis names the change, the metric, the expected direction and the audience it applies to. “Improve the homepage” fails all four. If there is no result that would prove you wrong, the change cannot teach you anything, whatever the numbers do afterwards.

This is the cheapest step in the CRO process and the one most often skipped, because it feels like paperwork. It is not paperwork — it is the thing that stops a flat result being argued away three weeks later.

Compare two versions of the same idea:

• Weak. “Add WhatsApp so it is easier to contact us.”
• Usable. “Adding a WhatsApp button beside the mobile form will raise total mobile enquiries by 10% or more within four weeks, because recordings show visitors tapping the phone number and leaving.”

The second version is falsifiable. If mobile enquiries move 1%, the hypothesis is wrong, and that is useful — the contact method was never the barrier. Keep every hypothesis to a single change; two changes in one release means an unreadable result, however clean the tracking is.

Common hypotheses worth borrowing sit in live chat versus a WhatsApp button, whether multi-step forms really get more enquiries, and 12 landing page fixes that lift leads.

7. Step 5: How Long a Readable Result Takes

Quick Answer: A split test needs enough enquiries per variant to separate a real lift from a quiet week. At 20 enquiries a month, even a 20% improvement takes over half a year to read. Below roughly 150 enquiries a month, fixed before-and-after windows are the honest method.

The right-hand column is the practical instruction. A before-and-after read is not a lesser method when volume is thin. It is the only one that finishes inside a quarter, provided you state the caveats: four clean weeks either side, no ad changes, no seasonal shift.

Two habits protect the read. Concentrate the test on one page so the sample is not spread across twenty URLs, and never call a result early because week one looked good. The mechanics are in A/B testing for marketers, and the recovery path in what to do when a test comes back inconclusive. The tactic most often misread is whether exit intent popups still work in Malaysia.

8. Step 6: What Following the Steps Is Worth

Quick Answer: When all six steps run, roughly 47% of shipped changes lift enquiries and 12% make things worse. When the change comes straight from an opinion, the win rate drops to 22% and more than a quarter of changes actively reduce enquiries. The process is the difference, not the talent.

Read the middle column before the first. Even with full discipline, four changes in ten do nothing at all. That is normal, and it is why the sixth step exists: revert cleanly, keep the note, and let the next cycle inherit the finding.

The right-hand column is the argument for the whole method. Shipping on instinct is not neutral — nearly a third of those changes cost enquiries, and without a baseline nobody notices for months. The work usually goes next into a page rebuild, covered in a landing page design service built to convert, or a wider look at demand in inbound versus outbound leads.

9. Where the Six Steps Break in Malaysian SMEs

Quick Answer: Three failures account for most stalled cycles: enquiries arriving on WhatsApp where nobody counts them, a rebuild landing mid-test and destroying the baseline, and the loop stopping after one round because the first change came back flat.

The steps are not hard. Keeping them running for six months while the business does everything else is hard. The usual break points:

• The uncounted channel. Half the enquiries arrive by WhatsApp and live in someone’s phone, so the site looks worse than it is and the wrong page gets blamed.
• The mid-cycle rebuild. A new theme goes live in week three of a four-week window. The read is gone, and so is comparability with anything before it.
• Stopping after one flat result. One change doing nothing is the expected case, not a verdict on the method.
• Optimising a page nobody visits. The polished service page gets 4% of traffic while the ad sends everyone to the homepage.
• A demand problem in disguise. If the enquiries that do arrive are unqualified, the site is working and the targeting is not.

The last one matters most. Conversion work raises the return on visitors you already have; it cannot manufacture interest that was never there. If that is your problem, weigh the risks of buying leads outright before spending another quarter on button placement, and read the wider picture in conversion rate optimisation basics for Malaysian websites.

10. Conclusion

Quick Answer: Run the CRO process in order, one change at a time, with the reading method matched to your enquiry volume. Measure for four weeks, research for one, rank honestly, predict a number, read it cleanly, then decide and go again.

The winning test at the end of the six steps is the smallest part of the work. It gets the attention because it is visible, but it only exists because the four steps before it narrowed a hundred possible changes down to one worth reading.

If you want the loop running without pulling your team off other work, ZenWeb runs measurement, research and build inside our web design services, so no step waits on another supplier.

11. Frequently Asked Questions

1. What are the six steps of the CRO process?

Measure what is happening now, research why it happens, then rank the leaks by people affected and effort. Next, write a hypothesis with a predicted size and read the change with a split test or a fixed before-and-after window. Finally, decide to keep, revert or retest.

2. How long does one CRO cycle take?

About eight to ten weeks on a typical Malaysian SME site. Four weeks for a clean baseline, roughly one week of research and ranking, a few days to build the change, then four weeks to read the result. Sites with heavier traffic can read a split test in one to two weeks instead.

3. Do I need a lot of traffic to run a CRO process?

No, but traffic decides the reading method. Below roughly 150 enquiries a month, split tests take too long to finish inside a quarter, so you fix evidence-backed defects and measure with fixed before-and-after windows. The first four steps work identically at any size.

4. What tools does the CRO process need?

Three categories: an analytics tool counting every enquiry action by device and source, a session recording and heatmap tool, and a way to build the change. A dedicated split testing tool only becomes necessary once your volume can actually read a test.

5. What if the change makes things worse?

Revert it and keep the note. Around 12% of changes reduce enquiries even when the full process is followed, which is exactly why the reading step exists. A negative result that you caught in four weeks costs far less than a redesign nobody measured.