12 things to check before you go live

Why a checklist beats a gut feeling

You test the parts you built. Your visitors, Google and email providers test everything else, and they don't tell you when something fails. They just leave, rank you lower or send your emails to spam.

Most launch-day problems aren't bugs in the product. They're settings nobody looked at, because they aren't on any screen you visit while building. The twelve checks below cover the ones that cost the most when they're missed.

Security basics (1 to 3)

Start here. These are the problems that hurt real people if they slip through.

• HTTPS on every page. Plain http should redirect to https, and the certificate shouldn't be close to expiring.
• Your secrets file isn't public. Open yourdomain.com/.env in a private window. You want a 404 page, not your keys.
• Private pages need a login. /admin, /dashboard, /settings and /api should send a stranger to the sign-in page, never show data.

Google and sharing (4 to 6)

These decide how you look before anyone clicks: in search results and in every chat where your link gets shared.

• A real title and description on every page, written for people. They're what Google shows under your link.
• Share tags (a title, a description and an image) so your link shows a proper card in Slack, WhatsApp or LinkedIn instead of a bare address.
• A sitemap that lists only your real pages, and a robots.txt that points to it. No staging or preview addresses in either.

Speed and images (7 to 9)

Speed is where images usually hide. A single 3 MB photo can undo everything else you did to make the page fast, and phones on a weak signal feel it first.

• The page answers in under a second and doesn't bounce through a chain of redirects first.
• Images are sized for the screen and saved as WebP or AVIF, which are usually much smaller than PNG or JPG at the same quality. Images below the fold can wait with loading="lazy".
• Phones get a proper layout: a viewport tag, text you can read without zooming and buttons you can tap.

Email that lands (10)

If people sign up, your domain needs three email records: SPF, DKIM and DMARC. Without them, welcome emails and password resets go to spam, and new users decide your product is broken.

These are settings where your domain is managed, not code, so no developer or AI tool can fix them from the codebase. Whoever owns the domain adds them once and never thinks about them again.

The small stuff people notice (11 and 12)

Nobody praises these when they're right. Plenty of people notice when they're wrong.

• No broken links. One dead link on a pricing page is enough to lose a sale.
• A real 404 page for addresses that don't exist, and alt text on images so screen readers and Google know what they show.

Run the whole list in 15 seconds

You can work through this list by hand in an afternoon. Or paste your address into Launch Check: it runs 38 checks in about 15 seconds, including the weight, load time and format of your images, and explains each problem in plain words.

Every report comes with a fix list you can hand straight to Claude Code, Cursor or Codex, with the items only you can change (like email records) marked separately. The free plan includes 3 checks a month.