Most website launch disasters are not caused by bad design. They are caused by a forgotten checkbox. A staging site that stayed blocked from Google. A contact form that quietly sends leads into a spam folder. An old URL structure that never got redirected, taking three years of rankings with it.
This website launch checklist is organized the way a launch actually happens: technical setup first, then content, then forms and email, then device testing, then your safety net. For every item you will find two things: what breaks if you skip it, and how to verify it in under five minutes. No agency jargon, no tools you need a subscription for.
Work through it top to bottom and you can go live on a Tuesday morning without holding your breath.
How to use this checklist
Block out two to three hours. Do not spread this over a week, because a site changes underneath you. Open your site in one browser tab and your hosting or CMS dashboard in another, then move through the six stages below in order.
| Stage | Items | Approx. time | Risk if skipped |
|---|---|---|---|
| 1. Technical setup | 1 to 7 | 45 min | Invisible site, lost rankings, browser warnings |
| 2. Analytics and tracking | 8 to 11 | 25 min | No data to prove the site works |
| 3. Content proofing | 12 to 16 | 40 min | Credibility damage, weak search snippets |
| 4. Forms and email | 17 to 20 | 30 min | Silent lead loss (the most expensive failure) |
| 5. Mobile and browsers | 21 to 23 | 30 min | Broken layouts for most of your traffic |
| 6. Backup and monitoring | 24 to 27 | 25 min | No way back when something goes wrong |
Stage 1: Technical setup (items 1 to 7)
This is where the real day-one disasters live. Everything here is boring and invisible, which is exactly why it gets skipped.
1. SSL certificate installed and HTTPS forced everywhere
What breaks: Browsers show a “Not secure” warning, checkout and form pages get flagged, and some visitors leave immediately. Website Launch Checklist: 13 Actionable Steps covers this in more depth.
5-minute check: Type your domain with http:// in front and confirm it jumps to https://. Then click the padlock in the address bar and check the certificate is valid and covers both yourdomain.com and www.yourdomain.com. Finally, open a few interior pages and look for a broken padlock, which usually means a mixed-content image or script still loading over http.
2. One canonical domain version (www or non-www)
What breaks: Google sees up to four versions of every page and splits your authority between them.
5-minute check: Manually load all four variants (http/https, www/non-www) of your homepage. All four should land on the same final URL. If not, set the preferred version in your CMS settings or add a redirect rule at the host level. An extended version exists for anyone curious.
3. Search engine blocking removed
What breaks: This is the single most common launch mistake. The site stays live but invisible in search for weeks because the staging block was never lifted.
5-minute check: In WordPress, go to Settings > Reading and confirm Discourage search engines from indexing this site is unchecked. Then visit yourdomain.com/robots.txt and make sure you do not see Disallow: /. Finally, view the page source of your homepage and search for noindex.
4. Redirect map from the old site in place
What breaks: If you are replacing an existing site and URLs changed, every old link, bookmark and search result becomes a 404. Traffic can drop 40 to 70 percent and stay there.
5-minute check: Before launch, export the old site’s URL list (from Search Console, your sitemap, or a crawler). After launch, paste 10 of the highest-traffic old URLs into your browser one by one. Each should 301 redirect to the closest matching new page, not to the homepage.
5. XML sitemap live and submitted
What breaks: Discovery of your new pages takes far longer than it needs to.
5-minute check: Visit yourdomain.com/sitemap.xml or /sitemap_index.xml. Confirm it lists real, live URLs and no staging domain. Then submit it in Google Search Console under Sitemaps.
6. Custom 404 page that keeps people on the site
What breaks: Visitors who hit a dead link get a blank server error and leave. There is more on it in Website Launch Checklist: Essential Steps.
5-minute check: Type yourdomain.com/this-page-does-not-exist. You should see a branded page with navigation, a search box and a link back to your main services or products.
7. Staging and development copies locked down
What breaks: Google indexes your staging site and it competes with (or outranks) the real one. Duplicate content, confused visitors, leaked draft pricing.
5-minute check: Search Google for site:staging.yourdomain.com and site:dev.yourdomain.com. If anything appears, password-protect the staging environment immediately and request removal in Search Console.
Stage 2: Analytics and tracking (items 8 to 11)
Launching without tracking means the first month of your new site is a black box. You cannot fix what you cannot measure.
8. GA4 installed and actually firing
What breaks: You get a permanent gap in your data and no baseline to compare against later.
5-minute check: Open GA4, go to Reports > Realtime, then load your site in a separate browser or on your phone. You should appear within 30 seconds. Click through three pages and confirm they all register.
9. Google Search Console verified
What breaks: No indexing alerts, no crawl error reports, no keyword data, and no way to request a re-crawl when something goes wrong.
5-minute check: Add the property in Search Console, verify by DNS or by the GA4 connection, then use the URL Inspection tool on your homepage and click Request indexing.
10. Conversion events defined
What breaks: You see traffic but have no idea whether it turns into enquiries, calls or sales.
5-minute check: Decide what counts as a conversion (form submit, phone click, booking, purchase), then trigger each one yourself and confirm it appears in GA4 Realtime events. Mark them as key events.
11. Cookie consent and privacy compliance
What breaks: Depending on where your visitors are, tracking without consent can create legal exposure and unreliable data.
5-minute check: Open the site in a private window. The consent banner should appear before non-essential scripts load, and declining should genuinely stop them. Check your privacy policy names the tools you actually use.
Stage 3: Content proofing (items 12 to 16)
This is the stage clients notice and the stage that gets rushed. Do it with fresh eyes, ideally someone who did not write the copy.
12. Every page proofread, no placeholder text
What breaks: Nothing kills trust faster than “Lorem ipsum” on the About page or a phone number from the template demo.
5-minute check: Search your site for the words lorem, ipsum, TBD, placeholder and the theme developer’s name using site:yourdomain.com lorem in Google after indexing, or your CMS search before launch. Read the homepage, services and contact page out loud. You will find the same thinking at another agency that treats it the same way.
13. Unique title tags and meta descriptions
What breaks: Google writes its own snippet, usually a worse one, and duplicate titles make pages compete with each other.
5-minute check: List your top 10 pages and confirm each has a title under roughly 60 characters and a description under roughly 155, both unique. Your SEO plugin will flag duplicates in a single screen.
14. Clean heading structure
What breaks: Accessibility issues and a weaker understanding of your page topic by search engines.
5-minute check: On each main page, confirm there is exactly one H1 and that subheadings descend logically. A free heading-outline browser extension does this in one click.
15. Images compressed, sized and given alt text
What breaks: A 4 MB hero image single-handedly ruins your mobile load time, and missing alt text hurts accessibility and image search.
5-minute check: Right click your largest image, open it in a new tab and check the file size. Anything over 300 KB for a full-width image needs compressing (use WebP where possible). Then confirm meaningful alt text on images that carry information, and empty alt on purely decorative ones.
16. Legal pages, contact details and business info consistent
What breaks: Missing privacy policy, wrong phone number, or an address that does not match your Google Business Profile, which weakens local search.
5-minute check: Confirm you have a privacy policy, terms, and visible contact details in the footer. Copy your name, address and phone exactly as they appear on your Google Business Profile and paste them side by side. They must match character for character.
Stage 4: Forms and email deliverability (items 17 to 20)
If you only have 30 minutes before launch, spend them here. A broken form does not throw an error, it just silently costs you customers for months.
17. Submit every form yourself, from a real address
What breaks: Leads vanish. The visitor sees “Thank you”, you receive nothing.
5-minute check: Fill in every form on the site (contact, quote, newsletter, booking) with a real personal email address. Use a test value such as “LAUNCH TEST” in the message field so you can find it later. Confirm you receive the notification and the visitor receives the confirmation.
18. Email authentication: SPF, DKIM and DMARC
What breaks: Your site’s emails land in spam or are rejected outright. This is the number one reason “the form does not work”.
5-minute check: Send a test email from the site to an address at a different provider (for example, a Gmail address if your business uses Microsoft). Open the message, view original or show details, and confirm SPF and DKIM both show PASS. If your host sends mail via PHP by default, switch to authenticated SMTP or a transactional email service.
Quick reference: where form emails usually go wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| No email at all | Host blocks PHP mail | Configure SMTP or a sending service |
| Lands in spam | SPF or DKIM failing | Add the correct DNS records |
| From address rejected | Form sends as the visitor’s address | Send from your domain, set reply-to as the visitor |
| Arrives hours late | Shared IP reputation | Move to a dedicated transactional provider |
19. Thank-you page and entry storage
What breaks: If email fails, you lose the lead entirely with no backup copy. You also cannot track conversions properly without a confirmation URL.
5-minute check: Confirm your form plugin stores submissions in the database as well as emailing them, and that successful submissions land on a dedicated thank-you URL you can use as a conversion trigger.
20. Spam protection that does not block real people
What breaks: Either your inbox drowns in bot submissions, or an aggressive filter silently rejects genuine enquiries.
5-minute check: Enable a honeypot field or invisible captcha, then submit the form once as a normal user to confirm nothing blocks you. Check your spam or blocked-entries log after 48 hours to see what it caught.
Stage 5: Mobile and cross-browser checks (items 21 to 23)
Browser resizing on a desktop is not a mobile test. Use actual devices.
21. Real phone test on the live URL
What breaks: Overlapping text, cut-off buttons, sticky headers that eat half the screen, tables that force horizontal scrolling.
5-minute check: Open the live site on your own phone and one other (ideally one iOS and one Android). Scroll every key page, open the menu, tap the phone number, submit a form. Watch for elements that require pinching or zooming.
22. Cross-browser pass
What breaks: Layout quirks in Safari and Firefox that Chrome hides, especially with custom fonts, grid layouts and video backgrounds.
5-minute check: Load the homepage plus two interior pages in Chrome, Safari, Firefox and Edge. Compare the hero section, navigation and footer. Five minutes of side by side comparison catches most issues.
23. Speed and Core Web Vitals baseline
What breaks: Slow pages lose visitors before they see anything, and poor vitals hold back rankings on competitive terms.
5-minute check: Run your homepage and one key landing page through PageSpeed Insights on mobile. Note the LCP, CLS and INP values as your launch baseline. If LCP is above 2.5 seconds, the usual culprits are an uncompressed hero image, render-blocking fonts, or too many plugins.
Stage 6: Backup, monitoring and handover (items 24 to 27)
24. Full backup taken before and after launch
What breaks: A bad plugin update or a hacked file on day three, with no clean copy to restore.
5-minute check: Take a complete files-plus-database backup, confirm it stores off-server (not just on the same hosting account), and set an automatic daily schedule. Then actually open the backup file and confirm it is not 0 KB.
25. Uptime monitoring switched on
What breaks: Your site goes down on a Saturday and you find out on Monday from a customer.
5-minute check: Set up a free uptime monitor pinging your homepage every five minutes, with alerts to both email and SMS. Add a second monitor on a key interior page, because a homepage can respond while the rest of the site fails.
26. Security basics locked down
What breaks: New sites get probed within hours of going live. Default admin usernames and reused passwords are how most small business sites get compromised.
5-minute check: Confirm there is no user called “admin”, enable two-factor authentication on all administrator accounts, remove unused themes and plugins, limit login attempts, and make sure the CMS and plugins are fully updated.
27. Credentials documented and owned by you
What breaks: Six months later you need to move hosts or update DNS and nobody knows who holds the registrar login. This is the quiet disaster that costs businesses the most.
5-minute check: Create one document (in a password manager, not a spreadsheet) listing domain registrar, DNS provider, hosting, CMS admin, email provider, analytics and any third-party services. Confirm the accounts are registered in the business’s name, not the developer’s.
The first 48 hours after launch
Your website launch checklist does not end at go-live. Put these five things in your calendar:
- Hour 1: Crawl the live site with a free crawler and fix any 404s, broken images or redirect chains it finds.
- Hour 2: Submit the sitemap and request indexing for your five most important pages in Search Console.
- Day 1: Check GA4 Realtime is recording traffic from real visitors, not just you.
- Day 2: Review Search Console Coverage for pages excluded by noindex or robots.txt.
- Day 2: Send one more test form submission from a different email provider to confirm deliverability under real conditions.
Printable summary of the 27 checks
| # | Check | Stage |
|---|---|---|
| 1 | SSL valid, HTTPS forced | Technical |
| 2 | Single canonical domain version | Technical |
| 3 | Search engine blocking removed | Technical |
| 4 | 301 redirects from old URLs | Technical |
| 5 | XML sitemap live and submitted | Technical |
| 6 | Custom 404 page | Technical |
| 7 | Staging site locked and deindexed | Technical |
| 8 | GA4 firing on all pages | Analytics |
| 9 | Search Console verified | Analytics |
| 10 | Conversion events configured | Analytics |
| 11 | Cookie consent working | Analytics |
| 12 | All copy proofread, no placeholders | Content |
| 13 | Unique titles and meta descriptions | Content |
| 14 | Clean heading hierarchy | Content |
| 15 | Images compressed with alt text | Content |
| 16 | Legal pages and consistent NAP | Content |
| 17 | Every form submitted and received | Forms |
| 18 | SPF, DKIM and DMARC passing | Forms |
| 19 | Thank-you page and stored entries | Forms |
| 20 | Spam protection tested | Forms |
| 21 | Tested on real phones | Devices |
| 22 | Chrome, Safari, Firefox, Edge pass | Devices |
| 23 | Core Web Vitals baseline recorded | Devices |
| 24 | Off-server backup verified | Safety net |
| 25 | Uptime monitoring with alerts | Safety net |
| 26 | Security hardening and 2FA | Safety net |
| 27 | Credentials documented and owned | Safety net |
Want someone to run this checklist for you?
At Custom Web Promotions, we run a version of this exact website launch checklist on every site we build and on plenty we did not. If you are launching soon, or you suspect an existing site went live with a few of these boxes unticked, get in touch and we will run a pre-launch audit before you press the button.
Frequently asked questions
How long before launch should I start this checklist?
Start the content and design items two weeks out, and run the full technical list within 24 hours of go-live. Technical items such as redirects, SSL and DNS have to be checked against the live environment, so they cannot be finished early.
What is the most commonly forgotten item on a website launch checklist?
Two tie for first place: leaving the site blocked from search engines (item 3), and never testing where form notifications actually land (items 17 and 18). Both are invisible, which is exactly why they go unnoticed for weeks.
Do I still need redirects if my new site uses the same URLs?
If every URL is genuinely identical, you still need the http to https and www consistency rules. But verify rather than assume, because CMS platforms often change trailing slashes, category paths or blog prefixes without you noticing.
What is the best day and time to launch a website?
Tuesday or Wednesday morning, early in your working day. Avoid Friday afternoons and holiday weekends. You want your developer, your host’s support team and yourself all available for the first few hours after the DNS change.
How long does it take for a new site to appear in Google?
Usually a few days for the homepage and a few weeks for the full site, assuming nothing is blocking crawlers. Submitting your sitemap and requesting indexing for key pages in Search Console speeds this up considerably.
Is a website launch checklist different for an ecommerce site?
The 27 items above all still apply, plus a full test purchase using a real card, tax and shipping rule verification, inventory sync, order confirmation emails, and a refund test in your payment gateway. Never launch a store without completing one genuine end-to-end transaction.
What should I do if something breaks right after launch?
Do not panic-edit live files. Check your uptime monitor and error logs first, then roll back to the backup you took in item 24 if the problem is widespread. Most day-one issues are DNS propagation, caching or a plugin conflict, and all three are reversible within minutes if your backup is in place.