The Before-You-Launch Checklist for a First Website

A website launch is a dozen small jobs, and the one you forget is the one visitors find. This checklist covers them all, in the order that makes sense to check them.

Work through it top to bottom. Tick each item only when it is actually done, not when it is nearly done. Print the page if that helps. One item in this list applies only to WordPress sites, and it is clearly marked. Skip it entirely on hand-built or Joomla sites.

Setup

1. Domain and hosting confirmed. The domain’s DNS records point at the live host. The site loads on the live domain. The hosting plan is settled. Avoid bargain shared hosting for anything you plan to grow.
2. HTTPS and SSL live. The security certificate is installed and valid. All pages redirect from HTTP to HTTPS. No mixed-content warnings appear. The padlock shows in the browser.
3. Backups configured, and one taken. Automatic backups are set up. At least one complete backup is taken before launch and stored somewhere separate from the host. Where the site has a database, the backup includes it. Restoring from a backup has been tested. The minimum is one pre-launch backup stored separately. The ongoing practice is an automatic schedule.
4. Software up to date, admin secured. The content system, themes, and plugins are on current versions. Admin accounts use strong, unique passwords. Two-factor protection is switched on where it is available (a second check, like a code on your phone, when signing in).

Content

5. No placeholder content. No filler text remains anywhere. Every page is proofread. Facts, dates, prices, and contact details are current.
6. Contact information correct. Addresses for mail work. Phone numbers are accurate. Physical addresses match. Social links go to the right profiles.
7. Every form tested end to end. Each form submits. Required fields and email format are validated. Errors are shown clearly. A thank-you page appears. Confirmations are sent. Submissions land in the right inbox or database.
8. All links work. Every internal and external link is clicked and confirmed. No broken links. Feeds are checked where the site has them.
9. Images optimized, with alt text. Images are compressed without visible quality loss, in appropriate formats. Every image carries alt text: descriptive for informative images, empty (alt="") for decorative ones. Images display correctly at all screen sizes. For the full rules on alt text, see links, images, and lists, done properly.
10. Favicon created and showing. The site icon is created, uploaded, and showing in the browser tab. Provide the icon in several sizes, and check it in more than one browser.
11. Legal and privacy pages published. The privacy policy, terms of service, and cookie policy where cookies are used are published, and they match what the site actually does. Where cookies or analytics are used, a consent banner is shown and visitor preferences are respected. Privacy and cookie requirements depend on where the site owner and the visitors are. This checklist is not legal advice.

Testing

12. Custom 404 page. A branded “page not found” page offers a way back: navigation to the main pages, or search. Friendly in tone, not alarming.
13. Cross-browser check. The site is checked in Chrome, Safari, Firefox, and Edge. Layout is correct. Features work. No console errors appear.
14. Tested on a real phone. Layout, menu, and forms are checked on an actual handset, in both orientations, and on a tablet where possible. Text is readable without zooming. Buttons are tappable. No horizontal scrolling.
15. Speed basics. Loading time is checked with PageSpeed Insights, Google’s free speed-checking tool. Images are compressed. Browser caching is enabled. A content delivery network is in place where one is used. One guide sets a target of 90 or above on mobile and desktop. Treat that as a target, not a pass-or-fail gate.
16. Accessibility basics. Color contrast meets accessibility standards. Forms have proper labels. The site works with a keyboard alone. Screen readers can reach the content.

Go live

17. SEO basics: title and meta. Every page has a unique title tag carrying its keyword, and a meta description. On this site, meta descriptions run 120 to 155 characters, with the keyword in them. One H1 (the page’s main heading) per page, with headings in order. Clean, descriptive URLs. Pages link to related content.
18. Sitemap and robots file. An XML sitemap (a list of your pages, written for search engines) is generated, covering the important pages, and submitted to Google Search Console. The robots file is configured, blocking admin and sensitive areas, and it points to the sitemap.
19. Development blocks removed. “Under construction” settings and noindex settings (settings that tell search engines not to list the site) are switched off. The site is set to be indexed. Caches are cleared.
20. Analytics set up, if day-one data is wanted (optional). Analytics is installed and verified as tracking, with Search Console verified, before launch if day-one data matters to you. This is not a launch blocker. Launching without it is fine.
21. WordPress only: hardening. Only for WordPress sites. The default database table prefix is changed. Debugging constants are set to false. The theme and plugin editor is disabled. The WordPress version is hidden. The sample configuration file is removed. User permissions and the admin address are reviewed. Skip this item entirely on hand-built or Joomla sites.

Launch day

Read the list once more, top to bottom. If every box is honestly ticked, launch. If one box is not, fix it first. The list will still be here.

If you are still building, the basics series will help: what a database is, planning your tables on paper, the skeleton of every page, and links, images, and lists.