The pre-launch checklist we run on every site

Every site we launch, including this one, goes through the same list before DNS points at it. It is not long. It exists because each line is something that once went wrong on a live site and cost a day or a customer. We run it as a script where we can and by hand where we cannot.

Search basics, checked by a script

• Every indexable URL answers 200, and the sitemap lists exactly those URLs with a real last-modified date.
• One H1 per page, and the title is the H1's lead-in. Titles are 60 characters or fewer, descriptions between 120 and 155. Longer ones get rewritten by Google; shorter ones waste the space.
• A canonical tag on every page pointing at itself, on the apex domain. The www host redirects to the apex with a 301, and so does http.
• Heading levels never skip. An H3 under an H1 with no H2 between them is a template bug, and the script catches it.
• Every internal link resolves. The script follows every href on every page and fails on anything that is not a 200 or a redirect.
• Unknown URLs return a real 404 status, not a 200 with an empty page. Retired URLs return 410. Old URLs that moved return 301 to the new page, one to one.
• Open Graph image on every page, fetched to confirm it is really an image.
• Structured data mirrors the visible page. Organization, breadcrumbs, articles where there are articles, FAQ only where the questions are on the page. Nothing the page cannot prove.

Speed, on a phone

• Largest paint, layout shift and blocking time measured on a throttled phone profile, not on a laptop on office Wi-Fi.
• Only the image that is actually the largest paint gets priority loading. Everything else lazy.
• One font family, loaded once, or the system stack.
• No third-party script that nobody can explain. Analytics loads when the browser is idle, and not at all for automated browsers.
• Static assets cached for a year with a content hash in the name; HTML never cached in the browser.

The browser test

• Open every page in a real Chromium on a phone-sized and a desktop-sized viewport. Zero console errors. Zero hydration warnings.
• No horizontal scroll at 375 pixels wide.
• Tab through the page: every control reachable, focus visible, the mobile menu traps focus and closes on Escape.
• Every touch target at least 44 pixels tall. Text contrast checked from the token list, not by eye.

Forms and money

• The contact form submitted for real, with the email arriving in the right inbox and the visitor landing on a thank-you page.
• The spam honeypot and the rate limit tried on purpose.
• If there is a checkout: one real purchase on the cheapest item, refunded afterwards, and an unsigned POST to the webhook URL that must get a 400, not a 502.

Rollback and monitoring

• The previous build is still a tagged image and can be started with one command. We try it once before launch.
• A watchdog checks the site every few minutes and restarts the container or alerts a person.
• Search Console and Bing Webmaster Tools have the sitemap. IndexNow gets the changed URLs on every deploy.

Copy

• A banned-word list is part of the build. Words we do not use on client sites include anything that claims to be number one, promises a result, or gives numbers without a date and a source.
• Every number on the site has the date it was measured next to it.

The list changes when something new goes wrong. That is the point of writing it down.