Practitioner resource / 30 checks / Updated July 30, 2026
A website is ready when the evidence survives the launch.
A practitioner-built website launch checklist covering ownership, accessibility, performance, SEO, analytics, forms, security, and rollback evidence.
How to use it
Assign one owner to each gate. Record the URL, device, expected result, observed result, evidence link, and decision. A checked box without evidence is only confidence.
- Test the production candidate, not an earlier design.
- Use representative content, accounts, and devices.
- Hold the release when a critical path lacks an owner or recovery plan.
- Repeat changed gates after every material fix.
Ownership and recovery
A launch is unsafe when the team cannot control or restore the system.
- Production hosting, domain, DNS, repository, analytics, email, and vendor accounts have named owners.
- A current backup exists and someone has verified how restoration works.
- The deployment and rollback steps are written, reproducible, and available to the release owner.
- Secrets are stored outside the repository and production access follows least privilege.
Critical user journeys
A page loading is not evidence that the business path works.
- Navigation, search, forms, login, checkout, booking, email, and confirmation states have expected results.
- Success, validation failure, provider failure, duplicate submission, and cancellation paths were tested.
- Representative journeys were completed on a real phone, keyboard-only navigation, and a desktop browser.
- The team knows which failure stops the launch and which issue can be documented for follow-up.
Accessibility and content
People need to perceive, understand, and operate the release.
- Every page has one descriptive heading hierarchy, meaningful link labels, and useful alternative text.
- Keyboard focus is visible; dialogs, menus, forms, and errors work without a pointer.
- Color contrast and zoom were checked, and motion respects reduced-motion preferences.
- Names, prices, contact details, dates, policies, and factual claims were reviewed by an accountable owner.
Performance and resilience
Lab scores are clues; representative behavior and failure recovery are the release evidence.
- Mobile LCP, INP or interaction proxies, CLS, server response, and major asset weight were measured.
- Images have dimensions and appropriate formats; fonts and third-party scripts have explicit reasons to exist.
- Slow connections, cache misses, empty states, API timeouts, and unavailable dependencies fail clearly.
- Monitoring covers uptime and the business-critical path, not only the homepage.
Search and answer-engine access
Canonical, crawlable, well-attributed pages are easier to discover and quote accurately.
- Intended public URLs return 200, use self-referencing canonicals, and are reachable through crawlable links.
- Robots directives and the XML sitemap include public pages while excluding auth, admin, API, and duplicate URLs.
- Titles, descriptions, visible headings, dates, authorship, and page-appropriate structured data agree.
- Changing facts cite primary sources; summaries, definitions, limitations, and next steps are explicit.
Measurement and launch control
A release needs evidence that it reached people and still completes its intended job.
- GA4 or the chosen analytics tool receives a live page view from production.
- Primary CTA, form start, form completion, checkout, booking, or other key events appear in realtime reporting.
- Consent and privacy behavior match the published notice and do not transmit unnecessary personal data.
- Baselines, release time, owner, acceptance results, monitoring window, and rollback threshold are recorded.
Release decision
Ship only when the remaining risk is named, owned, and recoverable.
Critical paths pass, evidence is recorded, monitoring is active, and rollback remains possible.
A critical result is unknown, an owner is missing, or recovery has not been demonstrated.
Production behavior crosses the agreed threshold for availability, conversion, data integrity, or security.
Method and sources
Built from standards, then shaped by production practice.
This checklist is practitioner guidance, not a guarantee, compliance certification, penetration test, or substitute for requirements specific to your organization.
Google Search Essentials and SEO guidanceW3C Web Content Accessibility Guidelinesweb.dev: Core Web VitalsOWASP Web Security Testing Guide