Research & Analysis Checklist for Web Development

Use Similarweb and Ahrefs to find traffic leaders, then confirm front-end and back-end stacks with Wappalyzer, BuiltWith, and StackShare. Focus on competitors serving similar personas and complexities to avoid skewed benchmarks.

Inspect page headers and HTML to infer SSR, SSG, or ISR usage, and confirm frameworks like Next.js, Remix, or SvelteKit with response hints and build artifacts. Note runtime choices such as Node, Deno, or Edge Workers to understand latency and cold start profiles.

Catalog auth, billing, i18n, offline support, and accessibility, then record how each is implemented, for example PKCE vs implicit for OAuth, or WCAG 2.2 conformance levels. Use a spreadsheet with evidence links and screenshots to keep assessments auditable.

Export OpenAPI specs or use GraphQL introspection to diff schema size, error codes, and pagination patterns. Record rate limits, overage charges, and SLA terms from docs so you can forecast integration risk and cost.

Use Can I Use and HTTP Archive trends to validate support for features like native lazy-loading, AVIF, and CSS container queries. Decide on minimum versions by correlating market share with your audience analytics to reduce polyfill and bundle bloat.

Scrape pricing pages and terms to extract billable dimensions such as monthly active users, API calls, edge invocations, and data egress. Convert to comparable unit economics so you can forecast total cost of ownership under realistic loads.

Run Lighthouse CI for lab data, and pull field data via Chrome UX Report and BigQuery to capture real-user LCP, INP, and CLS. Compare against performance budgets and industry percentiles to detect regressions with context.

Use webpack-bundle-analyzer or source-map-explorer to identify oversized dependencies, duplicate libraries, and unused exports. Check for unnecessary polyfills, moment.js locales, or lodash submodules and document concrete removal opportunities.

Record waterfalls with Chrome DevTools and WebPageTest, then confirm cache-control, ETag, and vary headers. Test CDN configuration for stale-while-revalidate, brotli compression, and image transformations that reduce origin load.

Check for AVIF and WebP usage, responsive srcset, and preconnect or preload for critical assets. Inspect font strategy for subsetting, variable fonts, and unicode-range to cut blocking time and bandwidth.

Measure TTFB, TTI, and hydration timing across SSR, SSG, and RSC variations using user timing markers. Confirm server and edge colocation, and compare route-level hydration costs to identify candidates for islands or partial hydration.

Run Lighthouse PWA checks, audit service worker strategies such as stale-while-revalidate versus network-first, and validate manifest completeness. Test offline flows and background sync to quantify user experience during connectivity loss.

Scan with SSL Labs and securityheaders.com to verify HSTS, CSP, X-Frame-Options, and Referrer-Policy. Document CSP nonce or hash strategies and identify mixed content or third-party script risk hot spots.

Use tools like Auth Playground and manual flows with interceptors to confirm PKCE, same-site cookies, and secure refresh logic. Test token rotation, revocation, and scope minimization to reduce hijacking risk.

Run Snyk or OWASP Dependency-Check, compare severity and reachable vulnerabilities, and measure mean time to upgrade. Track critical transitive dependencies and document safe upgrade paths or patches.

Run OWASP ZAP against staging and manually validate CSRF protections, input validation, and CORS restrictions on preflight requests. Confirm that error messages leak no sensitive stack traces or identifiers.

Use FOSSA or Licensee to inventory direct and transitive licenses and flag copyleft risks like AGPL. Formalize policies for allowed licenses and ensure attribution files and NOTICE requirements are met.

Check GA4 Consent Mode, CMP integration, and cookie storage patterns for compliance with GDPR and CCPA. Confirm data processors, retention windows, and cross-border transfer mechanisms are documented and enforceable.

Review tsconfig for strict flags, noImplicitAny, and exactOptionalPropertyTypes, and ensure ESLint extends recommended and security rules. Measure unresolved type issues and rule deviations to estimate remediation scope.

Generate coverage reports with Jest or Vitest and cross-check critical paths with Cypress or Playwright e2e tests. Track quarantined tests, flake rates, and average run time to prioritize stabilization work.

Inspect CI pipelines for dependency caching, parallelization, and container reuse to cut wall time. Monitor failure causes and rerun rates, and compute cost per successful build in GitHub Actions or GitLab CI.

Use SonarQube or CodeClimate to track cyclomatic complexity, duplicated blocks, and high-churn files. Identify refactoring candidates by combining complexity with change frequency from git history.

Adopt Pact for consumer-driven contracts and Schemathesis to fuzz OpenAPI endpoints, then wire into CI. For GraphQL, validate schema changes with static checks and contract tests against persisted queries.

Check Storybook coverage for critical components, ensure controls and accessibility addons are used, and align MDX docs with code. Confirm API docs are generated from source using Swagger or Redoc to prevent drift.

Review GA4 or Mixpanel events for consistent naming, units, and PII handling, and publish a tracking plan. Add versioning and deprecation tags so you can evolve schemas without breaking dashboards.

Deploy RUM via SpeedCurve, New Relic Browser, or Elastic, with sampling aligned to traffic and SLAs. Add application version tags and git SHAs to correlate performance and error spikes with deployments.

Map key steps such as sign-up, onboarding, and first successful action, and instrument timers for time to first value. Use exploratory analysis to identify drop-offs and quantify opportunity for UX improvements.

Audit feature flags and A/B platforms like LaunchDarkly, GrowthBook, or Statsig for bucketing integrity and SRM detection. Confirm event export to a warehouse and define minimum sample sizes by metric variability.

Run axe-core and Lighthouse accessibility tests, then manually validate keyboard navigation, screen reader semantics, and focus management with NVDA or VoiceOver. Track WCAG violations and remediation owners.

Configure Sentry or Rollbar with source map uploads, environment tags, and sampling limits to prevent alert fatigue. Set grouping rules for known error signatures and add regression labels on deploys.

Standardize a repo structure with folders for screenshots, HAR files, Lighthouse JSON, and analysis notebooks. Commit raw artifacts and derived CSVs to preserve reproducibility and enable audits.

Run Lighthouse CI, k6, and WebPageTest scripted tests in CI with fixed device emulation and network throttling. Pin Node and browser versions, and publish artifacts for diffing across branches.

Weight categories such as Core Web Vitals, security posture, and test coverage by their impact on revenue and risk. Make weights and formulas transparent so stakeholders can challenge and adjust assumptions.

Schedule jobs to track bundle size, CWV percentiles, and dependency update status, then post diffs to Slack. Add thresholds that trigger issues when budgets are exceeded or vulnerabilities appear.

Use provider calculators and past bills to model egress, storage, and compute for serverless and container options. Include cold start latency, edge vs region placement, and CDN offload when comparing designs.

Produce one-page summaries with charts, heatmaps, and a clear recommendation, then link to HAR files, scripts, and dashboards. Include assumptions, alternative options, and expected impact on KPIs.