Website launch checklist

Go through this list the day before launch, and again an hour after the DNS change.

Domain and DNS

• The domain is registered for at least a year, with auto-renew on.
• Both example.com and www.example.com work, and one redirects to the other.
• MX, SPF, DKIM and DMARC records are in place if the domain sends email.
• The DNS TTL was lowered a day before the switch.

Security

• An SSL certificate is installed and every page redirects from HTTP to HTTPS.
• No page loads images or scripts over plain HTTP (mixed content).
• Admin accounts use strong, unique passwords and two-factor login where the platform supports it.
• The CMS, theme and plugins are on their latest versions; unused ones are removed.
• Debug mode is off and error messages do not show file paths.

Backups

• Automatic backups run, and at least one copy is stored off the server.
• One restore has been tested.

Content and SEO

• Every page has a unique title and meta description.
• The site does not block search engines (check robots.txt and "noindex" settings left over from development).
• An XML sitemap exists and has been submitted to Google Search Console.
• Old URLs redirect (301) to their new equivalents if this replaces an older site.
• Spelling, phone numbers, addresses and prices have been proofread.

Functionality

• Every form sends, and the messages arrive in the right inbox.
• Checkout and payment work end to end, including confirmation emails.
• The site works on a phone, a tablet and the main browsers.
• Pages load quickly on a mobile connection; large images are compressed.

Legal

• Privacy policy, terms and cookie notice are published where required.
• Contact details and company information are correct.

After launch

• Uptime monitoring is set up to alert someone.
• Analytics is recording visits.
• The error log is checked after the first day.