Website Launch Checklist

A comprehensive launch checklist covers seven domains: content (titles, meta descriptions, alt text, 404 pages), design and UX (mobile responsiveness, navigation, accessibility), SEO (sitemap, robots.txt, canonical URLs, schema markup, Search Console), performance (image optimization, minification, CDN, caching, Core Web Vitals), security (HTTPS, security headers, dependency audit), legal (privacy policy, cookie banners, terms of service, GDPR compliance), and post-launch (analytics, redirects from old site, monitoring).

Start the checklist 30-45 days before scheduled launch for new sites and 14-21 days for redesigns or migrations.

Pre-launch SEO essentials: every page has a unique title and meta description, canonical URLs are set, robots.txt allows the right pages, sitemap.xml is generated and submitted to Search Console, structured data (Organization at minimum, Product/Article/Local depending on site type) is implemented, all images have alt text, internal linking from key pages to other important pages is in place, redirects from any old URLs are mapped and deployed (for redesigns/migrations), and Google Tag Manager / Google Analytics 4 is installed and tracking.

For migrations, build a comprehensive redirect map before launch. Step 1: crawl the old site with Screaming Frog and export all URLs with their indexing status, traffic, and backlinks.

Aim for Google Core Web Vitals "Good" thresholds across all key pages: Largest Contentful Paint (LCP) under 2.5 seconds, Interaction to Next Paint (INP) under 200 milliseconds, Cumulative Layout Shift (CLS) under 0.1.

HTTPS site-wide via valid TLS certificate (Let's Encrypt is free; expiry alerts must be set up), HSTS header enabled (Strict-Transport-Security: max-age=31536000; includeSubDomains), Content-Security-Policy header configured, X-Frame-Options or frame-ancestors directive set to prevent clickjacking, no admin or staging URLs publicly indexable (check robots.txt and noindex tags), all third-party scripts audited for known vulnerabilities (run npm audit and dependency-check on production builds), forms protected by CSRF tokens and rate-limiting, file uploads scanned and stored outside the web root, database credentials never exposed in client code, and admin panels behind 2FA.

Minimum: Google Analytics 4 (free, comprehensive analytics), Google Search Console (free, search performance and indexing), and Google Tag Manager (free, simplifies tag deployment).

DNS cutover is the riskiest moment in any launch.

Required legal pages for most commercial sites: Privacy Policy (covers data collection, cookies, third-party sharing, data retention, user rights.

Test every form on the site with multiple data combinations: required field validation (try submitting with empty required fields), invalid format detection (bad email syntax, invalid phone format), edge cases (very long inputs, special characters, Unicode), and successful submission with downstream verification (does the data actually arrive in your CRM, email inbox, or database?).

Daily checks: Search Console > Coverage (catch indexing errors and 404s within hours, not weeks), Search Console > Performance (track impressions and clicks for top queries), uptime monitoring via UptimeRobot or Pingdom (alert at first downtime), real-user analytics via GA4 (track conversion rate, bounce rate, session duration vs pre-launch baseline).

Soft launch: deploying the new site to production but keeping it private (via robots.txt, IP whitelist, or password protection) so internal teams and beta users can validate functionality without external visibility.