Website launch checklist: everything to check before you go live

Why a list beats memory

Launch day is when small slips become public: the form that does not send, the missing page, the “noindex” tag left over from testing. These are rarely careless mistakes. They come from familiarity: after months of work, the team no longer sees the site as a visitor does. A website launch checklist moves the checking out of people’s heads and onto paper, and makes it repeatable.

The list below is organised by the risk each item prevents: what damages your image, what damages your visibility, what damages sales, and what exposes you legally. If your site runs on WordPress, the same points apply, and we flag the WordPress-specific ones. You can also run your key pages through the landing page audit for a quick first check on pages that are meant to sell.

Content and structure: what people see

• Every page has final copy: no placeholder text, no “coming soon” and no template headings.
• Contact details (phone, email, address, opening hours) are identical in the header, footer, contact page and Google Business Profile.
• Each page has a single main heading (H1) and logical subheadings.
• The menu leads to the important pages, and each service or product has its own page.
• Internal links work, and no page is an orphan with nothing pointing to it.
• Images are properly sized, clearly named and have descriptive alt text.
• Someone who did not work on the project reads everything: tired eyes miss typos.

A simple test: ask a friend to do one thing on your site (for example, request a quote) without telling them where to click. The places where they hesitate are the ones to improve.

Technical SEO: what Google sees

This is where many months of lost visibility begin, because the errors are invisible to the naked eye.

• Indexing allowed. On WordPress, check the “Discourage search engines from indexing this site” option in the reading settings; it must be off at launch. Check robots.txt too, so it does not block the whole site.
• Unique titles and descriptions on every page, with the keyword used naturally. You can see how they will look in results with the SERP snippet preview.
• One canonical URL. The versions with and without “www”, and with “http” and “https”, must all redirect to one, using a permanent (301) redirect.
• XML sitemap generated and submitted in Google Search Console.
• A 404 page that exists and points people back to useful pages.
• Redirects from old addresses if you are replacing an existing site. You can lose visibility if the old addresses vanish without a redirect. For larger changes, read our guide to migrating a website without losing SEO.
• Structured data where it makes sense (organisation, articles, products), tested with Google’s official tools; the markup does not guarantee rich results.

For how indexing works, see the official documentation at developers.google.com/search.

Speed and mobile display

On many business sites a large share of visitors arrive on a phone, so mobile is the real test. Check that:

• The site runs on HTTPS with a valid certificate and redirects from the insecure version.
• Mobile speed is measured with PageSpeed Insights or a similar tool. You are watching the Core Web Vitals metrics (LCP under 2.5 s, INP under 200 ms, CLS under 0.1), explained in our guide to website speed and Core Web Vitals.
• Images are compressed and have declared dimensions, so the page does not jump while loading.
• Display is tested on a real phone, not just in the browser’s device emulator: buttons large enough, text readable, no sideways scrolling.
• Unneeded plugins are deactivated and deleted. Every plugin adds code and a security risk.
• Third-party fonts and scripts are limited to what you genuinely need.

Forms and conversion: what brings in money

A beautiful site with a broken form is like a billboard with the wrong phone number. Test every form from start to finish:

1. Complete the form on a phone and on a computer, with real details.
2. Check that the email arrives in the right inbox and not in the spam folder. If you rely on the server’s default mail sending, a properly configured SMTP plugin helps.
3. Check the confirmation message: people need to know it worked.
4. Test the errors: an empty field, an email without @, a phone number in the wrong format. The messages should be clear.
5. Check what happens to the data: where it is stored and who has access.
6. On mobile, the phone number dials with one tap and the address opens the map.

A thank-you page after submission is also useful for measurement, because it gives you a clear conversion point.

Measurement: without data, promotion is guesswork

Install measurement before launch, not after. Otherwise you lose the first days, which are exactly the days that show how people react.

• Analytics is installed and verified with real data (you can use the tool’s debug mode).
• Conversion events are defined: form submission, phone click, email click, purchase, as relevant. Our guide to conversion tracking with GA4 and the Meta Pixel walks through the steps.
• Advertising pixels fire only after consent, if you use them; for Google Analytics 4 and Google Ads in the EU, also check your Consent Mode v2 set-up.
• Campaign links are built with the UTM link builder, so you know where visitors come from.
• The site is added and verified in Google Search Console, with the sitemap submitted.
• Internal traffic (your team, developers) is excluded so it does not distort the numbers.

Legal and GDPR: what protects you

The legal side cannot wait until “after launch”: if the site collects data or sets cookies, the obligations apply from day one.

• A real privacy policy and cookie policy using your company’s details, not copied text.
• The cookie banner works: non-essential scripts (analytics, advertising) do not run before consent.
• Forms carry a privacy notice and, where relevant, a separate tick-box for marketing communications.
• Company identification details (name, tax ID, registration number, registered office) are visible.
• For online shops: terms and conditions, returns information and the other consumer information required by law, including out-of-court dispute resolution details (check the current requirements; the EU online dispute resolution platform was discontinued in 2025).

For information only: this list does not replace legal advice. Requirements depend on what your site does. Ask a lawyer or a data protection officer (DPO). More on cookies in our guide to GDPR and cookies on your website.

Security and backups

• Automatic backups, with a restore tested at least once.
• Unique, strong passwords and two-step authentication for admin accounts.
• Test users and development plugins have been deleted.
• WordPress, the theme and plugins are up to date, with updates scheduled rather than postponed indefinitely.
• Login attempts are limited and forms have spam protection.

Launch day, step by step

1. Make a full copy of the old site and database, if one exists.
2. Prepare the redirects and test them on the staging version.
3. Move the domain or change the DNS records. Lower the TTL a day or two beforehand so the change spreads quickly.
4. Activate the HTTPS certificate and test the redirect chain (http, www, non-www).
5. Switch off indexing blocks and check robots.txt.
6. Submit the sitemap in Search Console.
7. Walk through the main pages and every form once more, on the live site.
8. Announce the launch to your team and customers only after these checks.

Avoid launching on a Friday evening or the day before a holiday: if something goes wrong, you need people available.

The first seven days after launch

Common launch mistakes

• “Noindex” left over from testing. The site can stay out of Google for months, and the cause is a single tick-box.
• Forms not tested on the live site. They work in staging but send no emails because of server configuration.
• Old addresses without redirects. Rankings and returning visitors can be lost.
• Double or missing tracking. Conversions counted twice, or not at all.
• A cookie banner that is only decoration. The scripts run anyway.
• Photos uploaded straight from the camera. Images of several megabytes make the page load slowly on mobile.
• No backup plan. A small problem turns into a big loss.

How we approach it

On the sites we build, a checklist like this one is part of the process: we run it on the staging site, then again on the live site after the move. Every item has an owner, and the client receives a ticked list rather than a bare “it’s ready”.

If you want a partner for the whole journey, see how we handle WordPress website development. After launch, routine checks (updates, backups, monitoring) can stay in a maintenance package. If you already have a site and only want a second pair of eyes, get in touch.

Terms you will hear

A 301 redirect is a permanent redirect from one address to another. Noindex is an instruction asking search engines not to show a page. A sitemap is a file listing the pages you want Google to discover. A canonical is the preferred address of a page when several versions exist. TTL is the time, in seconds, that a DNS record is cached before it is refreshed.

In short

• Check in order of risk: content, technical SEO, speed, forms, measurement, legal.
• Remove indexing blocks and test redirects before the DNS change.
• Test forms on the live site, with real emails.
• Install measurement before the first day of traffic.
• Watch errors and indexing for a week.