Before anything else: the three that break sites
These three account for most launch disasters, and all take under a minute to verify.
1. Check robots.txt. Visit yourdomain.com/robots.txt and confirm it doesn't say Disallow: /. A staging robots.txt deployed to production makes your site invisible to search engines.
2. Search your source for noindex. View source on a few pages and search for noindex. In WordPress, check that "Discourage search engines" is unticked. This is the single most common launch mistake.
3. Sweep for placeholder content. Search your codebase for "lorem", "ipsum", "TODO" and "FIXME". Shipped placeholder text is embarrassing, gets indexed, and on commercial pages can create real liability.
SEO foundations
4. Every page has a unique title (50–60 characters) and meta description (150–160). Duplicated titles across pages are a wasted opportunity — our meta tag generator previews how they'll look.
5. Self-referencing canonical tags are present and point at the right URL, not the homepage.
6. A sitemap.xml exists, lists only indexable URLs, and is submitted in Google Search Console.
7. Open Graph tags are set with a 1200 × 630 image at an absolute URL. Test with Facebook's Sharing Debugger — a broken share card undermines every link you post.
8. One canonical hostname. Pick www or non-www and 301 redirect the other; the same for http → https.
Performance
9. All images have width and height attributes so space is reserved before they load.
10. Below-the-fold images use loading="lazy" — and your hero image does not.
11. Images are compressed and served in modern formats. Unoptimised images remain the single biggest cause of slow pages.
12. Run PageSpeed Insights on your key templates and check Core Web Vitals — see our Core Web Vitals guide for what the numbers mean.
13. Caching headers are set: long cache lifetimes for fingerprinted assets, revalidation for HTML.
Accessibility
14. Navigate the whole site with only the keyboard. Every interactive element must be reachable, and focus must always be visible.
15. Text contrast passes WCAG AA — 4.5:1 for body text. Check your palette with the contrast checker, including placeholder text, which usually fails.
16. Every meaningful image has descriptive alt text; decorative images have alt="". Forms use real <label> elements.
Security and privacy
17. HTTPS works everywhere, with a valid certificate and auto-renewal configured.
18. Security headers are set — Content-Security-Policy, X-Content-Type-Options, Referrer-Policy at minimum. Confirm no API keys or secrets are in client-side code.
19. Legal pages exist and are linked: privacy policy, cookie policy, and a cookie consent banner if you use analytics or advertising. Non-essential cookies must wait for consent under UK and EU law.
Analytics and the safety net
20. Analytics is installed and firing, Search Console is verified with the sitemap submitted, and a custom 404 page exists that helps people find their way back rather than dead-ending them.
After you launch
Click through the live site on a phone, not just a desktop browser — mobile is where most visitors will arrive and where layout problems surface. Test your key user journey end to end on the real domain, since staging environments hide URL and HTTPS issues.
Then check Search Console after a week for crawl errors, and again after a month for indexing coverage. Launching is the start of the feedback loop, not the end of the work. The Dev Essentials page has deeper checklists for each of these areas with progress you can track.