The website launch checklist we use on every project

Launches rarely fail because of something dramatic. They fail because of something small that nobody owned. This is the checklist we run on every project, in the order we run it.

Content and SEO#

• Every page has a unique title and meta description.
• There is one main heading (h1) per page.
• Images have sensible file names and alt text.
• Placeholder text, test pages and dummy products are gone.
• Spelling, phone numbers, addresses and prices have been checked by the client.
• Open Graph images show correctly when the link is shared.
• A favicon and app icon are in place.
• The XML sitemap lists the pages you want found, and only those.
• “Discourage search engines from indexing this site” is unticked (Settings → Reading).
• Structured data validates for the organisation, articles and breadcrumbs.

Redirects and URLs#

• Every old URL is mapped to the most relevant new page.
• Redirects are permanent (301), and none chain through several hops.
• The site redirects to one version: HTTPS, with or without www, never both.
• There are no internal links still pointing at the old URLs.
• The 404 page is helpful, with search and links to key pages.

Here is how a redirect map looks in practice:

Performance#

• Field-ready: LCP, INP and CLS are within the good thresholds on a mid-range phone in testing.
• Images are sized for their slots and served as WebP or AVIF.
• Full-page caching and a CDN are switched on.
• Fonts are self-hosted and preloaded.
• Unused plugins and scripts have been removed.

Accessibility#

• Automated checks show no serious issues on the key templates.
• The main journeys work with a keyboard alone, with visible focus.
• Text contrast meets WCAG 2.2 AA in every theme the site offers.
• Forms have labels, helpful errors and no time limits.
• An accessibility statement is published.

Forms and integrations#

• Every form has been submitted on the live domain, and the notification email arrived.
• Spam protection is on, and it does not block real people.
• CRM, booking and payment integrations are in live mode, not test mode.
• Analytics, if you use it, records visits and respects consent.
• Thank-you pages and confirmation messages make sense.

Security and operations#

• A full backup was taken immediately before launch.
• Daily backups and uptime monitoring are running.
• Every administrator uses a strong password and two-factor authentication.
• Old staging and development sites are password-protected or removed.
• The SSL certificate is valid and renews automatically.
• DNS records for email (SPF, DKIM, DMARC) survived the move.

Legal#

• The privacy policy and cookie policy reflect what the site actually does.
• Consent is collected before any non-essential cookies are set.
• Company name, registered address and number appear where required.
• Terms of service are in place for any sales or bookings.

On the day#

1. Launch early in the week, early in the day.
2. Switch DNS or deploy, then clear every cache.
3. Submit the sitemap in Google Search Console and request indexing for the home page.
4. Click through every page in the main navigation on a phone and a laptop.
5. Watch error logs, uptime alerts and form submissions for the next 48 hours.