Website Launch Checklist (Pre & Post)

Use Screaming Frog or sitebulb to crawl the site. Filter by status code to find broken pages.

Test every form: contact, newsletter, quote requests, lead capture. Check spam folder for missed notifications.

Use Broken Link Checker (browser extension or CLI) or Screaming Frog. External links should open in new tab.

Required sizes: 16×16, 32×32, 180×180 (Apple). Check across Chrome, Safari, Firefox, Edge.

Default server 404 pages are jarring and drive visitors away. Include site header, search, and top navigation.

Both should redirect permanently (301) to the canonical version. Test both manually.

Test: navigate to http:// version — should redirect to https://. Check HSTS header is set in production.

Check expiry date. Set up auto-renewal via Let's Encrypt/Certbot or verify certificate management is automated.

Chrome DevTools → Console → look for "Mixed Content" warnings. Usually caused by hardcoded http:// image/script URLs.

Every img tag should have meaningful alt text. Decorative images should have alt="".

Structural HTML errors can break assistive technology and cause unexpected rendering issues.

Open DevTools → Console on every main page and user journey. Zero errors should be the target.

Critical: staging environments often have Disallow: / in robots.txt. This MUST be removed for production.

Submit to Google Search Console and Bing Webmaster Tools after launch. Verify auto-generation is working if using SSG.

Title tags are still a strong ranking signal. Each page needs a unique, descriptive title.

Not a direct ranking factor but drives click-through rate in search results.

Essential for social sharing. Verify with Facebook Sharing Debugger and Twitter Card Validator.

Prevents duplicate content issues. All pages should have <link rel="canonical" href="https://yoursite.com/page/">.

Organisation schema on homepage, Article schema on blog posts, Product schema if relevant. Test with Google Rich Results Test.

H1 is the most important on-page element. One H1 only, containing primary keyword.

File names contribute to image search ranking. Rename before uploading.

Good: /services/cloud-migration Bad: /page?id=47&cat=2. Avoid underscores in URLs.

Internal links distribute PageRank. Homepage and key service pages should be linked from relevant content.

Verify via HTML tag, DNS record, or Google Analytics. Submit sitemap after launch.

Run: git log --all -p | grep -E "(pass|key|secret|token)" before pushing. Use environment variables and .gitignore.

Test with securityheaders.com. At minimum: HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY.

CSP prevents XSS attacks. Use nonce-based CSP or hash-based for inline scripts.

Move or restrict access. Add IP allowlist and MFA to any CMS admin panel.

Test: navigate to /images/ or /assets/ — should return 403, not a file listing.

Run: npm audit, pip audit, or use Snyk. Address all Critical/High before launch.

At minimum: verify input validation/sanitisation, parameterised queries, auth/session management.

WAF protects against SQLi, XSS, and bad bots at the network edge before requests hit your application.

Required if collecting any personal data including IP addresses, cookies, or form submissions. UK GDPR requirement.

UK ICO guidance: analytics, marketing, and tracking cookies require opt-in consent. Strictly necessary cookies are exempt.

Especially important for e-commerce, SaaS, or service-based sites.

Run axe Chrome extension or Lighthouse accessibility audit. Fix all critical issues before launch.

Verify licences for: photos, icons, fonts, illustrations. Keep licence records.

UK limited companies must display company registration number on website.

Verify propagation with whatsmydns.net across multiple DNS providers globally.

Submit the XML sitemap immediately after launch. Request indexing for homepage and key landing pages.

Open GA4 → Realtime report and browse the site. Verify events are arriving.

Send a test through every form. Check spam folder. Verify SPF/DKIM/DMARC are set on the new domain.

Set up Better Uptime, UptimeRobot, or Pingdom before DNS cutover. Set SMS/email alert to CTO/IT on 1-minute downtime.

Include: CEO, Marketing, Sales, Customer Success. Provide the live URL and any tracking dashboard links.

First week is critical for Google's re-crawl of the site. Check daily for unexpected issues.

Only real-user data (CrUX) counts for Google ranking. Check PSI against live production URL.

Verify: form submissions, CTA clicks, and any e-commerce conversions are appearing in GA4 reports.

New user traffic patterns may expose edge cases that staging didn't catch.

Check hosting provider dashboard for unusual resource consumption. Scale if needed before load increases.