Site launch checklist

The list worth walking before a site goes live, and again after. Most of it takes minutes; all of it is cheaper now than after launch.

Before DNS points at the new site

• Every page has a unique <title> and meta description — not the CMS default repeated site-wide.
• One <h1> per page, and heading levels descend without skipping.
• A self-referencing absolute rel="canonical" on every page.
• No stray noindex. Check the response header as well as the meta tag — X-Robots-Tag wins and is invisible in the markup. This is the most expensive single mistake on the list.
• robots.txt exists, does not blanket-disallow, and names the sitemap.
• An XML sitemap with real lastmod values, listing only canonical, indexable, 200-returning URLs.
• Redirect map from every old URL to its closest new equivalent — one hop each, 301, never all to the home page.
• HTTPS works, the chain is complete (fullchain.pem, not cert.pem), and the certificate covers every hostname you serve.
• Port 80 redirects to HTTPS with a 301, and one of www/non-www redirects to the other.
• A missing URL returns a real 404, not a 200 with an error page.
• <html lang> set; viewport meta present without user-scalable=no.
• Structured data validates and describes what the page really is.
• Open Graph title, description and image on every shareable page.
• Images have alt attributes, declared dimensions, and are in a modern format.

Lower the DNS TTL first

At least one full old-TTL period before the switch, drop the TTL on the records you are changing to 300 seconds. Do this too late and the long TTL is still cached, which is how a planned ten-minute cutover becomes a day.

In the first hour after going live

• Scan the live hostname rather than staging — staging configuration is where noindex and blanket robots rules come from.
• Watch the access log for 404s and 5xx. Sort by count; the top ten will be real.
• Confirm an unknown hostname on the same server does not get handed this site’s certificate.
• Check security headers survived the deploy — a config overwrite is the usual way they vanish.
• Verify analytics is recording, on a page that is not the home page.

In the first week

• Verify the property in Google Search Console and Bing Webmaster Tools; submit the sitemap.
• Use URL Inspection on your most important pages and read what Google actually fetched.
• Set up external uptime monitoring — from outside your own network, on the HTTPS URL, alerting on certificate expiry as well as downtime.
• Confirm automated certificate renewal works, with a dry run rather than faith.
• Make one backup and then restore it somewhere. An untested backup is a hypothesis.
• Check the Core Web Vitals report once it has data, and compare it with your lab scores.
• Publish SPF, DKIM and DMARC if the domain sends mail — or a null MX and v=spf1 -all if it never will.