The signup flow audit: 15 things to check before you spend on ads

Signup flow optimisation starts with walking the whole path a paid visitor takes, from the landing page to the first useful thing they do in the product, and checking fifteen specific points along it. Most of the loss sits in four places: the jump from page to form, the form itself, verification, and an empty first session.

Do it before you raise the ad budget. Paid traffic magnifies whatever the flow already does, so a form that loses a third of people loses a third of every pound or dirham you spend, and no amount of better ad creative gets that back.

Each check below says what to look at and what good looks like. Run them as a stranger would, on a phone, with an email address the product has never seen.

Stage 1: landing page to form

• 1. The page repeats the promise that got the click. Check: open each live ad and the page it points to side by side. Good: the same headline idea, the same visual and the same offer in the first screen, so the visitor knows they are in the right place without reading.
• 2. One primary action, visible without scrolling on a phone. Check: load the page on a phone and count the buttons in the first screen. Good: one primary button that starts signup, with anything else styled as clearly secondary.
• 3. It says what happens next. Check: read the button and the line around it. Good: the visitor knows whether it is free, whether a card is needed and roughly how long setup takes before they click. Surprises at step three are where people leave.
• 4. It loads quickly on mobile data. Check: switch off Wi-Fi and time how long until the button is usable. Good: the button appears and works before the hero image finishes, and nothing jumps around as it loads.

Stage 2: the form

• 5. Every field earns its place. Check: list each field and name the decision it drives in the first week. Good: email and a password or a sign-in option, plus anything you genuinely cannot create the account without. Company size, role and phone number can be asked later, once the user has a reason to answer.
• 6. Sign-in options match the audience. Check: who signs up, and what are they already logged into? Good: Google or Microsoft sign-in for B2B products where work accounts live there, and a plain email option for everyone else. Three social buttons nobody uses just add clutter.
• 7. Password rules a human can satisfy first time. Check: try a long, ordinary passphrase. Good: no "one capital, one number, one symbol" rules, a show-password toggle, and a check against known-breached passwords instead. NIST's digital identity guidelines (SP 800-63B, revised in 2025) tell services to drop composition rules for exactly this reason.
• 8. Errors explain the fix and keep the data. Check: submit with a typo in the email and a short password. Good: the message appears next to the field, says how to fix it in plain words, and nothing already typed gets wiped.
• 9. The keyboard and autofill do the typing. Check: tap each field on a phone. Good: the email field brings up the email keyboard, and the correct autocomplete attributes are set so the browser and password managers can fill the form in one tap.

Stage 3: verification

• 10. Verification does not block the first session. Check: sign up and see whether you can use the product before confirming your email. Good: you land in the product straight away and confirm later, or the confirmation is a code you can enter without leaving the tab. A hard gate before any value is one of the most common leaks we find.
• 11. The email arrives fast and looks like you. Check: sign up with a Gmail and an Outlook address and time the email. Good: it arrives within seconds, in the inbox rather than spam, from a sender name the user will recognise, with a subject line that says what it is.
• 12. Codes and links work on the device people actually use. Check: request a code on desktop, open the email on a phone. Good: one-time codes can be typed on either device, links do not break when opened on a different one, the code field supports autofill, and there is a resend option with an honest wait time.

Regulated products carry an extra verification stage, KYC, and its position in the flow matters as much as its design. When we designed Ghanem, a Saudi platform for buying fractions of property, the journey runs from browsing a property and modelling its return, through KYC, to investing and cashing out. The person meets the product's value before they meet the document upload, and a user who has already modelled a return has a reason to finish it.

Stage 4: the first session

• 13. The first screen after signup is never empty. Check: look at exactly what a brand new account sees. Good: sample data clearly labelled as sample, or a single obvious first action with an explanation of what goes here. We wrote a whole piece on designing empty states, because this is where most paid signups quietly disappear.
• 14. Onboarding questions change what the user sees. Check: list every question asked after signup and what the product does with each answer. Good: each one changes the setup, templates or default view, there is a skip option, and none of them exist only to fill a CRM.
• 15. There is one first win, and you track it. Check: name the action that shows a new user has got real value, then confirm it fires as an event in your analytics. Good: most new users can reach it in the first session, and you can see the share who do by signup week. That action is your activation event, and we argue it is the metric that matters most at seed.

Where each stage leaks, and what to measure

If you can only instrument one stage this week, instrument the last one. A form that converts brilliantly into an empty product just moves the loss further down, where it is harder to see.

How to run it in an afternoon

• 30 minutes: ad to form. On your phone, on mobile data, click your three highest-spend ads and screen-record each journey to the signup form. Score checks 1 to 4.
• 45 minutes: the form. Sign up three times: once properly with a new Gmail address, once with deliberate mistakes, once with Google or Microsoft sign-in. Score checks 5 to 9.
• 30 minutes: verification. Repeat with an Outlook address, open the email on a different device from the one you signed up on, and time everything. Score checks 10 to 12.
• 45 minutes: first session. Use the fresh account as a new customer would for fifteen minutes without help. Screenshot every screen. Score checks 13 to 15.
• 30 minutes: write it up. Pull the drop-off for each stage from your analytics, put the failed checks next to the stage that leaks most, and fix that stage first.

Do it on one iPhone and one Android if you can, and ask someone outside the company to do the same run while you watch without helping. The places they hesitate will not be the places you expect.

What to fix first

Start with the stage that has the biggest drop-off, even if a different check annoys you more. Where we see the most expensive losses, it is usually verification gates and empty first sessions, because both lose people who have already decided to try you. The landing page fixes matter most once spend goes up, since they decide how many paid visitors start at all.

Most of the fifteen are small changes: a field removed, an autocomplete attribute added, a verification step moved later. A few, like the first session, are proper design work. None of them need a new ad budget, and all of them make the next one go further.