1C-Bitrix Code Audit: Diagnose Technical Debt and Plan Refactoring

Every change is a lottery

The project works, but you fix a feedback form — the cart breaks. A new developer spends a week understanding the structure; adding a simple page takes two days. The catalog loads in 5 seconds due to N+1 queries — customers leave. According to industry research, every second of load time costs 100,000 rubles in lost revenue. Our certified Bitrix specialists have over 10 years of experience and have audited 50+ projects. We guarantee a detailed report with actionable recommendations. Development speed drops, technical debt grows. We know how to fix it. Our code audit is an objective way to measure technical debt, document problems, and plan refactoring.

What problems are typical for Bitrix projects?

On a project with 3–5 developers, each writes in their own style. init.php often exceeds 2000 lines of handlers, half unused. SQL queries are scattered across templates. Infoblocks were created without structure — one block holds products, articles, and banners. Every fix takes half a day, and a change risks breaking neighboring functionality. In 90% of projects, we find N+1 queries that degrade performance. The audit systematically identifies bottlenecks and provides a concrete action plan with timelines. We don't just report — we show how to fix each issue and what the refactoring will achieve in numbers.

When is a code audit needed?

Signs that indicate an audit is necessary:

• Every release brings unexpected bugs — regressions in unrelated modules.
• Adding new functionality takes longer and longer (cyclomatic complexity increases).
• The team is afraid to refactor old code — no understanding of what will break.
• The project slows under load: pages take 3+ seconds to generate.

How Bitrix code audit differs from code review

Bitrix imposes its own patterns — components, templates, infoblocks, agents. Quality criteria are tied to them. A regular PHP audit doesn't account for API specifics: CIBlockElement, ORM, tagged caching, events. We check not just syntax, but compliance with platform best practices and SOLID principles.

What we check: three key areas

Infoblock architecture. Typical mistakes: one infoblock for heterogeneous entities (products and articles together); properties of type "String" instead of "Dictionary" — making filtering impossible; lack of composite indexes on b_iblock_element_property; storing data in PREVIEW_TEXT instead of separate fields. Proper design improves query performance by up to 70%.

Components and templates. Business logic in template.php instead of result_modifier.php — an antipattern. Direct SQL via $DB->Query() instead of ORM — reduces cohesion. Customization by modifying the kernel instead of extending class.php — problems with updates.

init.php. The main health indicator. On troubled projects — thousands of lines: handlers, functions, classes, SQL. On good ones — only an autoloader and event registration. The audit immediately reveals such "black holes".

How a code audit improves performance?

We use the performance monitor (perfmon) and enable $DB->ShowSQLStat = true. We count SQL queries per page. Normal: 30–80. Problematic: 300+ due to CIBlockElement::GetList() in a loop (N+1). We also profile PHP using Xdebug + Cachegrind. Our method identifies bottlenecks 3–5 times faster than manual testing.

Static analysis tools: phpstan/psalm — they find calls to non-existent methods. PHP_CodeSniffer — checks coding standards. We also measure coupling between components.

According to our statistics, after audit and remediation, performance improves by 40–60%. The audit costs from 50,000 rubles and typically pays for itself within 2 months due to reduced development time and increased revenue from faster page loads (saving up to 200,000 rubles per month).

How the audit works: step by step

1. Code and database collection — we clone the repository and dump the database.
2. Profiling — we run the performance monitor on typical pages.
3. Static analysis — we run phpstan/psalm to find errors and violations.
4. Manual audit — we check infoblocks, components, init.php, SQL.
5. Report generation — a table of issues, priorities, recommendations.

Our case study: N+1 in an online store catalog

We managed an online store project where the catalog page took 5 seconds to generate. Analysis showed: in a loop over 50 products, 6 additional queries were made per product for properties — a total of 301 queries. After refactoring using CIBlockElement::GetList() with proper $arSelect, the query count dropped to 3, and time to 0.3 seconds — a 16x improvement. The audit is 3–5 times more effective than manual testing for identifying such bottlenecks.

What's included in the report

After the audit, you receive:

• A table of issues with file, line, severity, and recommendation.
• A prioritized resolution plan with estimated effort.
• Recommendations for improving architecture and performance.
• Code examples for fixing typical errors.

How to order an audit?

Contact us for a preliminary assessment of your project. We'll provide a commercial proposal with timelines and cost. Order an audit and get a detailed refactoring plan with priorities and deadlines.

We recommend reviewing the infoblock API documentation for understanding best practices.

Bitrix Site Audit: Find Problems Before They Find You

Imagine: you open a project from a previous team — init.php has 3,000 lines, OnBeforeIBlockElementUpdate handlers are nested, there's a 4GB dump.sql in the site root, and the upload/ directory is larger than the database. We see such projects every week. And this is not an exception — it's the norm for Bitrix after several years of active development without quality control. An audit of a 1C-Bitrix site is the only way to objectively assess the real state of a project before investing in improvements or scaling. It reveals bottlenecks in code, database, server configuration, and security. Most importantly, it shows what to fix to make the site faster and prevent crashes during peak sales. Regular 1C-Bitrix site audit pays off in 2–3 months: hosting savings are substantial, and error fix time is cut by three times compared to a reactive approach.

Why is a Bitrix site audit necessary?

Changing contractors — you take over a project from another team and don't know what "mines" are left in the code. Event handlers in init.php, forgotten scripts, modified kernel files — all can backfire at the worst moment. We once found 47 handlers in one project, 12 of which were dead — information blocks were deleted, but the code kept calling CIBlockElement::GetList() on every hit. For several years of such load — millions of extra queries to the database.

Position drop — technical reasons almost always underlie organic traffic loss: page duplicates, broken canonical, 50,000 junk URLs in the index. An audit will show where Google is losing your traffic. In one typical project, the number of URLs with sorting parameters reached 300,000 — each combination of PAGEN_1=2&sort=price was indexed separately.

Slowness under load — the site goes down right during a sale, when every minute of downtime costs money. We find the reasons: unoptimized queries, lack of cache, heavy agents. For example, one query to b_iblock_element_property without an index can add 3–4 seconds to page generation time.

Suspicion of hacking — spam emails from the server, redirects to casino on mobile traffic, strange files in /bitrix/modules/. A security audit will reveal backdoors and web shells.

Before major improvements — investing in project development without knowing its real state is like building a second floor without checking the foundation. Half of our clients come precisely before starting new functionality.

What hides in init.php and the database?

Most problems on Bitrix are concentrated in three places: init.php, the database, and server configuration. We break down each layer in detail.

init.php and event handlers — the main code dump. There accumulate OnAfterUserLogin, OnBeforeOrderAdd, OnAdminContextMenuShow that no one refactors for years. In one project we found 47 handlers, 12 of which were dead (information blocks deleted, but the code kept calling CIBlockElement::GetList() on every hit). An audit clears out such ballast and reduces server load.

Versions and compatibility. Kernel version — if below 22.0, update is critical (PHP 8.1 not supported). Marketplace modules often conflict after updates. License without an active key — no security updates.

Server configuration. PHP memory_limit < 256M — problems with catalogs of 10,000+ items. OPcache revalidate_freq = 0 in production — CPU overloaded. MySQL innodb_buffer_pool_size should be 70–80% of RAM. On MySQL 8.0+ query_cache is removed, but it remains in old configs — generating errors in logs. Absence of expires for static files in nginx — each page reload downloads JS/CSS again.

Database — the most interesting part. The b_event_log table grows to gigabytes without cleanup settings. In one project it occupied 12 GB, though 500,000 records were written daily. The b_search_content_text table with a full-text index can weigh more than the content itself. Tables from deleted modules (b_forum_*, b_learning_*) take up space and slow down backups. We enable slow query log, wait a day, analyze. One query to b_iblock_element_property without an index can slow the entire site — we recorded delays up to 7 seconds per page.

File system. /upload/resize_cache/ — weighs tens of gigabytes, stores resizes of long-deleted images. Backups in the root — backup_old.tar.gz next to index.php, accessible via direct link. Manually modified kernel files will be overwritten during update, and custom logic will silently disappear.

How does SEO audit remove duplicates and trash from the index?

Filter and sort parameters generate thousands of URLs: /catalog/?PAGEN_1=2, /catalog/?sort=price&order=asc — each indexed as a separate page. Bitrix SEO module can set canonical, but by default it doesn't do it for parameterized URLs. The standard robots.txt blocks /bitrix/, but doesn't block /search/, /personal/, /ajax/ — there are thousands more junk pages. Bitrix's sitemap.xml generator sometimes includes inactive items and 404 pages. Without structured data Schema.org (Product, BreadcrumbList, Organization), snippets in search results are bland. Core Web Vitals: LCP > 2.5s on mobile is common for unoptimized Bitrix — unoptimized images and blocking JS are to blame. On average, after an audit we reduce the index by 60–80% — remove duplicates, set up canonical and proper noindex. Order an SEO audit to get your site the traffic it's losing now.

Why check Bitrix security?

SQL injections via $_REQUEST in custom components — previous developers don't always use $DB->ForSql(). XSS when outputting user input without htmlspecialcharsbx(). Custom file upload forms that don't check MIME type and extension — upload .php as an "image" and get a web shell. Typical findings: disabled "Proactive Protection" module (WAF not working, intrusion log empty), admin panel without IP restriction (/bitrix/admin/ open to the world), adminer.php or phpMyAdmin in the root — forgotten after migration, obfuscated code in .htaccess with mobile traffic redirect via RewriteCond %{HTTP_USER_AGENT}, modified kernel files with eval(base64_decode(...)) inserts. In one project we found 23 such files — the site had been distributing spam content via AMP for months. Read more about SQL injection and cross-site scripting. Contact us for a security check of your project — we will find vulnerabilities that scanners miss.

How do we improve performance?

We profile using Blackfire or Tideways — see which functions consume CPU. A frequent candidate is CIBlockElement::GetList() in a loop (classic N+1). We check hit rate of OPcache, Memcached, Bitrix managed cache. If composite site cache invalidates on every order, it's useless — we once reduced invalidations from 80% to 2% by proper tag configuration. Bitrix agents — if agents_use_crontab is not enabled, they execute on user hits; a heavy agent = slow for random visitor. Load testing: base RPS, degradation at 2× and 5× load, behavior when limit exceeded (graceful degradation or 502 Bad Gateway?). On one project we found peak RPS was 12, and after optimization became 150 — a 12.5x increase.

What do we look for in code?

We assess custom developments of previous teams: do they use D7 ORM or just $DB->Query() bypassing everything. PSR-12, autoloading, module structure — or everything in one file. N+1 — GetList() inside while($arItem = $rsItems->Fetch()) — classic. Modified kernel files (bitrix/modules/sale/lib/) with manual edits — updates will break everything. "Temporary" solutions living for three years — // TODO: redo from last year. On average, we find 15–25 problems in code per project, half of them with potential data loss.

Report format

Each problem is described by scheme: what we found → where → how it affects → how to fix → effort. We deliver the report in PDF and Google Docs for collaboration. Five signs that a Bitrix site needs an audit: init.php has grown over 2,000 lines; database exceeds 5 GB, and b_event_log table over 1 GB; pages load longer than 3 seconds on mobile; Search Console shows tens of thousands of pages in index with errors; you found files with suspicious content in /bitrix/modules/. If at least one point matches — time to order an audit.

How do we conduct an audit?

1. Access — Bitrix panel, SSH, database, Yandex.Webmaster, Search Console.
2. Automation — Bitrix "Quality Monitor", Screaming Frog, GTmetrix, security scanners. Catch 60% of problems.
3. Manual analysis — the remaining 40%. Architecture, code, business logic, configuration — only hands-on. Each audit is led by a senior developer with 10+ years of experience.
4. Report with priorities.
5. Discussion — meeting with you, answering questions, agreeing on a remediation plan.

Average time for a full cycle — 5 business days for technical audit, up to 3 weeks for comprehensive. We guarantee confidentiality of results and safety of your data.

What is included in deliverables?

• Documented report with description of each problem and fix recommendations.
• Checklist of critical vulnerabilities and their priority.
• List of performance optimization suggestions with impact assessment.
• Post-audit consultation — review of results, task prioritization.
• Access to test results (screenshots, profiling logs, raw data).

Types of audit and timelines

We have conducted 50+ audits of Bitrix projects — from online stores to corporate portals. Our experience shows: on average, an audit pays off within 2–3 months by reducing hosting costs and cutting error fix time (3 times faster than reactive approach). Regular audit is the best way to extend project life.

Result — not a stack of papers, but a guide to action with concrete tasks and priorities. Need an audit of your Bitrix site? Get a consultation today — contact us, and we will assess your project for free within 1 business day. Order a comprehensive audit to get the full picture before serious investments.