The Complete Website
Launch Checklist

Inspect every page's <link rel="canonical"> tag. Use absolute URLs (including protocol and domain) - never relative paths. Validate with Screaming Frog's "Canonicals" tab or curl -s URL | grep canonical. Consequence: Relative or missing canonicals cause duplicate content indexing, dilute PageRank across URL variants, and can split ranking equity across dozens of phantom pages.

Crawl the existing production site to extract every indexed URL. Map each to its new destination. Handle edge cases: query strings (/page?ref=abc), trailing slashes, and HTTP→HTTPS protocol upgrades. Test every redirect with curl -I -L oldurl and confirm a single 301 hop - no chains. Consequence: Unmapped URLs return 404s, instantly evaporating accumulated ranking authority. Redirect chains bleed ~15% PageRank per hop.

Generate an XML sitemap containing only indexable, canonical, 200-status URLs. For sites exceeding 10,000 URLs, split into sitemap index files with category-based child sitemaps (e.g., sitemap-blog.xml, sitemap-products.xml). Validate with xmllint --schema sitemap.xsd sitemap.xml. Consequence: Malformed sitemaps are silently ignored by Googlebot. Oversized single-file sitemaps (>50MB / 50,000 URLs) are partially processed, leaving deep pages undiscovered.

Confirm /robots.txt is served at the domain root with a 200 status code. Verify User-agent directives, Disallow rules, and the Sitemap: directive. Test with Google Search Console's robots.txt Tester. Consequence: A single misplaced Disallow: / blocks the entire site from indexing. Leftover staging noindex directives from development are a top-5 launch failure cause.

Create a branded 404 page with navigation, search, and links to high-value pages. Verify it returns an actual HTTP 404 status - not a soft 404. Test with curl -o /dev/null -s -w "%{http_code}" https://domain.com/nonexistent. Consequence: Soft 404s waste crawl budget and pollute your index. Google explicitly penalizes sites with excessive soft 404 patterns.

Add og:title, og:description, og:image (1200×630px minimum), og:url, and og:type tags. Set twitter:card to summary_large_image. Validate with Facebook's Sharing Debugger and Twitter's Card Validator. Consequence: Missing OG tags produce ugly, text-only link previews - reducing click-through rates on shared links by 30–50% compared to rich image cards.

Add Organization schema on the homepage with logo, social profiles, and contact info. Add WebSite schema with a SearchAction for sitelinks search box eligibility. For physical locations, add LocalBusiness schema. Validate with Google's Rich Results Test. Consequence: Without structured data, you forfeit rich result eligibility - knowledge panels, sitelinks search boxes, local packs.

Choose a single canonical URL format and enforce it server-side with 301 redirects. Test that /About, /about/, and http://domain.com/about all resolve to the same canonical. Consequence: Multiple URL variants fragment link equity and create duplicate content signals, harming crawl efficiency and ranking consolidation.

Add visible breadcrumb trails on all pages below the homepage. Mark them up with BreadcrumbList JSON-LD schema listing each ListItem with position, name, and item URL. Validate with Google's Rich Results Test. Consequence: Breadcrumb schema enables breadcrumb-style URLs in SERPs, improving CTR and providing Google with a clear site hierarchy signal.

If serving content in multiple languages, add <link rel="alternate" hreflang="xx"> tags. Include a self-referencing hreflang and an x-default fallback. Validate bidirectional return links with Screaming Frog's hreflang audit. Consequence: Missing or asymmetric hreflang annotations cause Google to serve the wrong language version, cannibalizing traffic between regional pages.

Every page must have a unique <title> tag. Keep titles under 60 characters or 580 pixels. Place the primary keyword within the first 50 characters. Check pixel rendering with SERP snippet preview tools. Consequence: Duplicate or truncated titles reduce CTR from search results. Google may auto-rewrite your title if it deems it unhelpful.

Write action-oriented meta descriptions for every indexable page. Include a value proposition and a soft call-to-action. Avoid duplicating descriptions across pages. Consequence: Missing meta descriptions let Google auto-generate snippets - often irrelevant previews that suppress CTR by 20–30%.

Each page must have exactly one <h1>. Subheadings must follow logical hierarchy - never skip from H2 to H4. Remove decorative headings. Audit with HeadingsMap or document.querySelectorAll('h1, h2, h3, h4, h5, h6'). Consequence: Multiple H1s dilute topical focus. Broken hierarchies impair screen reader navigation (WCAG 1.3.1) and weaken featured snippet extraction.

Flag all internal links returning 4xx or 5xx. Replace generic anchors ("click here") with keyword-relevant phrases. Update links pointing to intermediate redirects - link directly to final URLs. Consequence: Broken internal links waste crawl budget and orphan pages. Generic anchors miss topical relevance signals. Internal redirect chains add latency and leak PageRank.

Convert images to AVIF (primary) with WebP fallback using <picture> elements. Define responsive srcset and sizes. Set explicit width and height on every <img>. Add descriptive alt text. Lazy-load below-fold images with loading="lazy". Consequence: Missing dimensions cause CLS failures. Legacy formats are 25–50% larger than AVIF/WebP, inflating LCP times.

Submit every form with valid and invalid data. Confirm CSRF tokens are validated server-side. Verify transactional emails arrive in inbox - not spam. Validate SPF, DKIM, and DMARC records with dig TXT domain.com or MXToolbox. Consequence: Missing CSRF tokens expose forms to CSRF attacks. Failed SPF/DKIM causes emails to land in spam, silently breaking lead capture.

Search the DOM for lorem ipsum, TODO, [placeholder], {{variable}}, and test content. Verify CMS custom fields render correctly. Use grep -ri "lorem\|TODO\|placeholder" ./public. Consequence: Placeholder text on production destroys credibility and is indexed by search engines.

Generate favicon.ico (32×32), apple-touch-icon.png (180×180), and Android/Windows tile PNGs. Create a site.webmanifest with name, theme_color, and icon references. Consequence: Missing favicons make your site look unfinished in browser tabs, bookmarks, and mobile home screen shortcuts.

Scan with axe DevTools or Lighthouse Accessibility. Fix missing alt attributes, insufficient contrast ratios (<4.5:1), missing form labels, and non-keyboard-navigable elements. Test tab order and focus states. Consequence: Accessibility failures expose the business to ADA/EAA legal liability and exclude ~15% of the global population.

Test on Chrome, Firefox, Safari, and Edge (latest two versions). Validate on physical iOS Safari and Android Chrome. Confirm responsive breakpoints at 375px, 768px, 1024px, 1280px, and 1536px. Consequence: Safari and Firefox render CSS grid/flexbox differently. Untested layouts break for 15–30% of traffic, increasing bounce rates.

Identify the LCP element on each key page with Lighthouse. Preload the LCP image with <link rel="preload" as="image">. Self-host fonts with font-display: swap. Inline critical CSS. Consequence: LCP above 2.5s at the 75th percentile fails Core Web Vitals, triggering a ranking demotion. Every 100ms of delay correlates with ~1% conversion drop.

Reserve explicit dimensions for images, videos, iframes, and ad slots. Use CSS aspect-ratio for responsive embeds. Avoid injecting content above existing content after load. Profile with the Web Vitals Chrome extension. Consequence: CLS above 0.1 fails Core Web Vitals and causes misclicks - particularly damaging on mobile.

Break up long tasks (>50ms) using requestIdleCallback, scheduler.yield(), or setTimeout(fn, 0). Defer or async-load all third-party scripts. Avoid synchronous DOM reads followed by writes (forced reflow). Consequence: INP replaced FID as a Core Web Vital in March 2024. Scores above 200ms are penalized.

Configure text-based assets with Brotli (Content-Encoding: br) as primary and Gzip as fallback. Verify with curl -H "Accept-Encoding: br" -I https://domain.com. Consequence: Brotli achieves 15–25% better compression than Gzip. Uncompressed transfers are 3–5× larger, inflating TTFB and LCP.

Test with curl --http2 -I https://domain.com or the Chrome DevTools Network Protocol column. If behind a CDN, verify HTTP/3 is enabled. Consequence: HTTP/1.1 limits concurrent connections to ~6 per domain. HTTP/2 multiplexing reduces load times by 20–40% for asset-heavy pages.

Set Cache-Control: public, max-age=31536000, immutable for fingerprinted static assets. Set Cache-Control: no-cache for HTML documents. Verify with curl -I. Consequence: Missing cache headers force browsers to re-download assets on every visit. Over-caching HTML causes users to see stale content.

Run production builds with minification and tree-shaking enabled. Verify no unused CSS ships to production. Confirm no dev-mode libraries ship (React warnings, source maps). Check bundle sizes with webpack-bundle-analyzer. Consequence: Unminified bundles are 30–60% larger, degrading INP and TBT scores.

Inventory every third-party script. Load non-critical scripts with defer or async, or load dynamically after DOMContentLoaded. Use Chrome's "Third-party badges" and performance.getEntriesByType('resource'). Consequence: A single synchronous third-party script can block rendering for 2–5 seconds. Third-party scripts are the #1 cause of INP failures.

Deploy static assets through a CDN with edge locations near your audience. Verify assets are served from edge nodes (check X-Cache: HIT or cf-cache-status headers). Set up cache purge in CI/CD. Consequence: Serving from origin adds 50–300ms of latency for distant users. CDN cache misses during launch can overload the origin.

Add <link rel="preconnect"> for critical third-party origins. Use <link rel="preload"> for hero images and critical fonts. Apply <link rel="prefetch"> for next-page resources. Avoid over-preloading. Consequence: DNS+TCP+TLS to a new origin takes 100–300ms. Preconnect eliminates this. Missing preloads for LCP assets add 200–500ms to LCP times.

Set Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. Submit to hstspreload.org. Scan for mixed content with grep -r "http://" ./public. Consequence: Without HSTS, browsers allow HTTP downgrade attacks. Mixed content breaks the padlock icon and Chrome blocks mixed active content.

Deploy Content-Security-Policy restricting script sources. Set X-Frame-Options: DENY. Set X-Content-Type-Options: nosniff. Start CSP in report-only mode, then enforce. Verify at securityheaders.com. Consequence: Missing CSP enables XSS injection. Missing X-Frame-Options enables clickjacking. These are OWASP Top 10 risks.

Run openssl s_client -connect domain.com:443 to inspect the certificate chain. Verify SAN entries cover all subdomains. Confirm auto-renewal via ACME/Certbot. Test with SSL Labs - target A+. Consequence: An expired SSL certificate triggers browser warnings that block all traffic. Broken chains cause trust errors in specific browsers.

Deploy a consent banner that blocks non-essential cookies until consent is granted. Publish Privacy Policy, Terms of Service, and Cookie Policy in the footer. For CCPA, include a "Do Not Sell" link. Verify no tracking fires before consent. Consequence: GDPR fines up to €20M or 4% of annual turnover. CCPA violations carry $7,500 per intentional violation.

Confirm automated snapshots are running for database and file system. Test a full restore to staging. Document the rollback procedure. Set a rollback decision window (e.g., "if conversion drops >50% in 4 hours, rollback"). Consequence: Without a tested rollback plan, catastrophic launch failures have no recovery path. Average unplanned downtime costs $9,000/minute.

Revoke temporary accounts. Remove debug endpoints (/debug, /phpinfo). Ensure .env, .git, and source maps aren't publicly accessible. Test with curl -I https://domain.com/.env. Consequence: Exposed .env files leak database credentials and API keys. Accessible .git directories expose your entire source code.

Implement rate limiting on auth endpoints, API routes, and forms. Enable bot challenges for suspicious traffic. Test failover with k6 or artillery. Consequence: Launch announcements attract bot traffic. Unprotected forms get spammed within hours, polluting CRM data.

48 hours before launch, lower TTL to 300 seconds. After stable (24–48h post-launch), raise to 3600–86400. Verify with dig +short domain.com and whatsmydns.net. Consequence: High TTL during cutover means some users see the old site for up to 24 hours. Rollback is delayed by the same duration.

Set up external monitoring polling critical pages every 60 seconds from multiple locations. Configure Slack/PagerDuty alerts. Create a status page. Test by temporarily returning a 503. Consequence: Without monitoring, downtime goes undetected for an average of 3.5 hours. Each hour compounds revenue loss.

Confirm production matches staging: OS, runtime versions, database engine, environment variables. Verify production .env values point to production endpoints. Run your full test suite against the production build. Consequence: Environment drift causes "it works on staging" failures. A mismatched runtime version can cause silent data corruption.

Install the GTM container in <head> and immediately after <body>. Verify with Preview & Debug mode. Confirm the container ID matches production. Consequence: A missing GTM container means zero analytics data from launch day - irreplaceable baseline data is lost.

Set up GA4 with the correct Measurement ID. Configure enhanced measurement and custom events for form submissions (generate_lead), CTA clicks, tel: links, video engagements. Mark key events as conversions. Verify in GA4 DebugView. Consequence: GA4 does not retroactively process events. Unconfigured conversion events mean unmeasurable launch-day ROI.

Add and verify the production domain (use Domain property type for full coverage). Submit XML sitemap in both platforms. Request indexing for the homepage and top 10 priority pages. Consequence: Without Search Console, you have no visibility into indexing errors, crawl issues, manual actions, or search performance data.

Submit test entries through every form and verify they arrive in production CRM with correct field mapping. Confirm lead assignment rules, notification emails, and automated sequences trigger. Consequence: Broken webhooks silently drop leads. If forms don't reach the CRM, sales sees zero inquiries - those leads are unrecoverable.

Deploy pixels through GTM (not hardcoded). Configure conversion events. Verify with Meta Pixel Helper, LinkedIn Insight Tag checker, and Google Tag Assistant. Ensure pixels respect cookie consent. Consequence: Missing pixels mean paid campaigns cannot optimize for conversions - costing 3–5× more per conversion.

Test that UTM parameters persist through navigation and are captured in form hidden fields or GA4 session data. Verify values in GA4 Traffic Acquisition. Confirm canonicals strip UTMs. Consequence: Broken UTM tracking makes it impossible to attribute leads to campaigns, making marketing spend unaccountable.

Deploy Sentry, LogRocket, or Bugsnag for JavaScript exceptions. Configure server-side structured logging with error alerting. Set up log aggregation to detect 5xx spikes. Consequence: Without monitoring, JS errors in specific browsers go undetected, silently blocking conversions for a segment of users.

Create IP filters in GA4 to exclude team IPs and VPN ranges. Enable bot filtering. In GTM, suppress tags when a custom cookie (e.g., internal_user=true) is set. Consequence: Unfiltered internal traffic inflates pageviews and skews conversion funnels - especially damaging in the first week when baselines are set.

Build funnel explorations for each conversion path (e.g., Homepage → Service Page → Contact → Thank You). Define steps using page_view events or custom events. Create comparison segments (mobile vs. desktop, organic vs. paid). Consequence: Without funnels configured before launch, you cannot identify where users drop off - diagnosing issues requires weeks of retroactive analysis.

Confirm window.dataLayer is initialized before the GTM container. Verify all custom pushes (e.g., dataLayer.push({event: 'form_submit', form_id: 'contact'})) fire correctly. Use GTM Preview's "Data Layer" tab. Test edge cases. Consequence: A malformed dataLayer breaks all downstream tags - analytics, pixels, and remarketing all fail silently.