Guides/The website launch checklist (2026)

The website launch checklist (2026)

48 checks across SEO, sharing, accessibility, AI search, speed, security, and legal. Tick them off as you go and download your progress.

Updated October 13, 202612 min readFor: Indie hackers, freelancers, agencies

On this page

How to use this checklist
SEO basics
Sharing and brand
Accessibility (WCAG 2.2 AA)
AI search visibility
Speed (Core Web Vitals)
Security
Legal, analytics, and operations
The week after launch
Questions

How to use this checklist

Work through it on staging first, then once more on the live domain right after DNS switches. Tick items as you go; progress is saved in this browser. Items with a link open a free tool that checks it for you.

It is ordered by impact: SEO and sharing mistakes are the most visible on launch day, accessibility and security lower your legal and security risk, and speed fixes pay off over time.

0 of 48 done

SEO basics0/8

Unique title on every page (30–60 characters)Put the most important words first. No duplicate titles across pages. Meta tag checker →
Meta description on key pages (70–160 characters)Write it like ad copy: what the page offers and why to click. Meta tag checker →
One H1 per page that matches the topicUse H2 and H3 for sections, in order, without skipping levels.
Canonical URL on every pagePick www or non-www, trailing slash or not, and point canonicals there.
No leftover noindex from stagingCheck meta robots and the X-Robots-Tag header on the live site. Meta tag checker →
XML sitemap live and submittedSubmit it in Google Search Console and Bing Webmaster Tools.
robots.txt allows crawling and lists the sitemapA staging Disallow: / on production is the classic launch-day disaster. Robots.txt generator →
No broken internal linksTest navigation, footer, and in-content links. Broken link checker →

Sharing and brand0/6

og:image at 1200×630 with an absolute URLThis is what people see when your link is shared. Keep text away from the edges. Meta tag checker →
og:title and og:description setThey can differ from the SEO title: shorter and punchier works better in feeds.
twitter:card set to summary_large_imageWithout it, X shows a small thumbnail.
Favicon and Apple touch iconSVG or 32×32 PNG favicon plus a 180×180 apple-touch-icon.
Organization or product structured dataJSON-LD with your name, logo, and social profiles on the home page. Schema generator →
Helpful 404 page that returns HTTP 404Link to the home page and search. A 404 page that returns 200 is a soft 404.

Accessibility (WCAG 2.2 AA)0/8

Text contrast at least 4.5:13:1 for large text and UI components such as icons and input borders. Contrast checker →
Alt text on meaningful imagesDecorative images get alt="" so screen readers skip them.
Every form field has a visible labelPlaceholders are not labels. Error messages say how to fix the problem.
Everything works with a keyboardTab through the page: menus, modals, carousels, and forms. No keyboard traps.
Visible focus indicatorNever outline: none without a replacement. WCAG 2.2 also requires focused items not to be entirely hidden behind sticky headers.
Touch targets at least 24×24 pxNew in WCAG 2.2 (2.5.8). 44×44 is better for primary actions.
lang attribute on <html>Screen readers use it to pick the right voice and pronunciation.
Accessibility statement publishedExpected under the European Accessibility Act if you sell to EU consumers. Statement generator →

AI search visibility0/6

AI search crawlers are allowedOAI-SearchBot, PerplexityBot, and Claude-SearchBot must not be blocked if you want to be cited. AI crawler checker →
Decide on AI training crawlers on purposeBlock GPTBot, ClaudeBot, and Google-Extended only if you want to opt out of training. Robots.txt generator →
CDN or firewall is not blocking AI botsBot protection settings can block crawlers before robots.txt is read.
Main content is in the server HTMLMost AI crawlers do not run JavaScript. Use server rendering or static generation.
llms.txt publishedA short Markdown map of your key pages for AI assistants. Cheap to add. llms.txt generator →
Key questions answered in plain textPricing, what the product does, and who it is for, stated clearly on the page.

Speed (Core Web Vitals)0/7

LCP under 2.5 secondsPreload the hero image, do not lazy-load it, and serve WebP or AVIF.
CLS under 0.1Set width and height (or aspect-ratio) on images, videos, embeds, and ads.
INP under 200 msBreak up long JavaScript tasks and defer third-party scripts.
Images sized for the screenUse srcset and sizes so phones do not download desktop images.
Fonts do not block textSelf-host, subset, and use font-display: swap or optional.
Third-party scripts auditedRemove unused tags, chat widgets, and pixels. Load the rest after interaction where possible.
Static assets cached and compressedLong cache headers for hashed files, Brotli or gzip for text.

Security0/7

HTTPS everywhere with HTTP redirecting to HTTPSAlso check that www and non-www both end on the same canonical host.
Strict-Transport-Security headermax-age of at least six months; two years when you are confident. Security headers checker →
Content-Security-Policy (start in report-only)Limits where scripts load from; the strongest defense against XSS. Security headers checker →
nosniff, frame protection, Referrer-PolicyThree one-line headers many hosts do not send by default. Security headers checker →
No secrets in client-side codeSearch your bundle for API keys. Only public keys belong in the browser.
Forms protected against spamHoneypot, rate limit, or a privacy-friendly CAPTCHA on public forms.
SPF, DKIM, and DMARC set for your domainSo your transactional emails land in the inbox, not spam.

Legal, analytics, and operations0/6

Privacy policy and terms linked in the footerSay what you collect, why, and who processes it.
Cookie consent where requiredIn the EU and UK, non-essential cookies need consent before they are set.
Analytics installed and verifiedCheck real-time view after launch. Set up the key conversion events.
Google Search Console verifiedSubmit the sitemap and watch the Pages report in the first weeks.
Every form tested end to endSubmit each one on the live domain and confirm the email or webhook arrives.
Uptime and error monitoring onKnow about downtime and JavaScript errors before your users tell you.

The week after launch

Check Search Console daily for crawl errors and pages excluded by noindex.
Share a link on X, LinkedIn, and Slack to confirm previews in the wild.
Watch real-user Core Web Vitals once traffic arrives; lab scores are only an estimate.
Re-test forms and email delivery from a device that is not yours.
Fix anything urgent, then schedule a monthly re-check.

Questions

What should I check before launching a website?+

At minimum: titles and descriptions, no leftover noindex, a working robots.txt and sitemap, share images, keyboard access and contrast, HTTPS with security headers, Core Web Vitals, working forms, analytics, and legal pages. The checklist on this page covers 48 items across seven areas.

How long does a launch check take?+

About an hour by hand for a small site the first time. With the free tools linked from each item, or the Shipcheck extension, most of the automated checks take a few minutes, leaving time for the manual ones such as keyboard testing and form submissions.

Is my progress saved?+

Yes, in this browser only, using local storage. Nothing is sent to a server. Download the Markdown file to share progress with your team or attach it to a client handoff.

What is most often forgotten?+

A noindex or Disallow: / left over from staging, missing share images, forms that only worked on staging, and HTTP not redirecting to HTTPS. They take minutes to fix and are painful to discover a week after launch.

Tools for this guide

Meta tag & social preview checker

See your Google, X, LinkedIn, and Slack previews and fix titles, descriptions, and OG images.

Open tool →

Security headers checker

Grade HSTS, CSP, and four more headers, then copy the config for your host.

Open tool →

AI crawler checker

See which of 16 AI crawlers your robots.txt allows or blocks, with a copy-paste fix.

Open tool →

More guides

European Accessibility Act: a practical guide for small teams

Who the EAA applies to, what it requires, and a step-by-step plan to work toward compliance without an enterprise budget.

Read · 10 min →

Robots.txt for AI crawlers: get cited by ChatGPT, Perplexity, and Claude

The difference between AI search and AI training bots, the exact robots.txt rules to use, and the mistakes that make sites invisible to AI answers.

Read · 8 min →

Core Web Vitals fixes: LCP, CLS, and INP in plain English

What each metric measures, the thresholds Google uses, and the fixes that actually move the numbers on real sites.

Read · 11 min →

Automate the checks a tool can do

The Shipcheck extension runs the automatable parts of this list (HTTPS, security headers, a real 404, legal pages, analytics, sitemap, and share cards) on any tab, including staging, and exports a white-label PDF when you hand off.

Free: meta tags, share previews, headings, images, and favicon. Accessibility, AI search, Web Vitals, launch checks, fix prompts, and reports need Pro ($20 once).

Install Shipcheck free See Pro