QA & Testing for UK eCommerce — UK GDPR Built In

eCommerce Performance Testing

eCommerce performance testing is critical — poor Core Web Vitals damage Google rankings (LCP, CLS, INP). k6 performance testing: model realistic shopping journeys (browse, add to basket, checkout), not just endpoint pings. Black Friday load test: 10x normal traffic. Google Lighthouse CI: automated LCP, CLS, INP monitoring in CI/CD pipeline. Akamai mPulse or similar RUM (Real User Monitoring): production performance monitoring across UK ISPs.

PCI-DSS Checkout Testing

PCI-DSS v4.0 Requirement 6.4.3: all scripts on payment pages must be authorised and integrity-verified. Testing approach: automated inventory of all JavaScript tags loading on checkout pages (Content Security Policy violations detected in CI/CD), SRI hash validation, and manual review of third-party scripts. Requirement 11.6.1: anti-web-skimming tests — simulate Magecart-style script injection and verify detection mechanism triggers.

PECR Cookie Testing

PECR consent testing: Playwright automated tests verifying no analytics cookies set before consent, consent banner appears on first visit, consent preferences are stored correctly, and consent can be withdrawn. UK ICO guidance: consent must be freely given, specific, informed, and unambiguous — automated tests verify all four criteria. Consent management platform (CookieBot/OneTrust) regression: verify consent signals passed correctly to all analytics tools.

Accessibility Testing for eCommerce

Equality Act 2010: reasonable adjustments for disability include accessible eCommerce. Key eCommerce accessibility tests: product image alt text (screen reader describes product), price display (not colour-only), add-to-cart keyboard navigation, checkout form label association, error identification (not colour-only), and basket/checkout flow NVDA walkthrough. WCAG 2.1 AA on checkout is FCA Consumer Duty-relevant if financial products sold.

UK GDPR

PECR

Consumer Rights Act

PCI-DSS SAQ-A

Equality Act