Deploy ChecklistStart checking

Know exactly what could
block your launch.

A practical, source-backed checklist for websites and web apps. Find the risky gaps, verify the fix, and ship with confidence.

Start with 15 essentialsBrowse the plan
  • 36 production checks
  • No account needed
  • Progress saved locally

Browse your launch plan

Six focused passes take you from “it works locally” to ready for real traffic.

Launch essentials

The production basics that prevent broken launches.

  • Domains
  • HTTPS
  • Core journey
7 checks · 6 essential

Search & discovery

Make important pages understandable and discoverable.

  • Metadata
  • Indexing
  • Sitemaps
6 checks · 2 essential

Performance

Keep the first visit fast and the interface responsive.

  • Core Web Vitals
  • Media
  • Caching
6 checks · 1 essential

Accessibility

Make every critical path operable and understandable.

  • Keyboard
  • Forms
  • Zoom
6 checks · 2 essential

Security & privacy

Reduce common exposure before real traffic arrives.

  • Headers
  • Sessions
  • Privacy
6 checks · 2 essential

Monitoring & recovery

Know when production fails and how to recover safely.

  • Analytics
  • Alerts
  • Recovery
5 checks · 2 essential

One checklist. Every high-risk detail.

Begin with the essentials, or open all 36 checks for a complete production review.

Production preflight

Deployment checklist

0of 15 essential checks complete

Progress is saved on this device.

Checklist depth

Launch essentials

The production basics that prevent broken launches.

0 of 0 complete

  • Set one canonical production URLChoose the single HTTPS URL that represents the live site.Launch blocker

    How to verify

    1. Open the production domain and confirm it loads the intended release.
    2. Check that alternate hostnames and URL variants resolve to the preferred URL.
    Google: canonical URLs
  • Confirm HTTP redirects to HTTPSProtect visitors and keep one secure version of every URL.Launch blocker

    How to verify

    1. Visit the HTTP version of the domain in a private browser window.
    2. Confirm it reaches the matching HTTPS page in a single permanent redirect.
    MDN: transport security
  • Verify production environment variablesMake sure required configuration exists outside local development.Launch blocker

    How to verify

    1. Compare the production variable names with the application configuration contract.
    2. Restart or redeploy and confirm the app starts without missing-variable errors.
    OWASP: secrets management
  • Test the primary user journey end to endComplete the action that gives the site its reason to exist.Launch blocker

    How to verify

    1. Start from a new private session on the production domain.
    2. Complete the primary flow and confirm the expected success state and side effects.
    web.dev: user-centric performance
  • Confirm DNS and the custom domainVerify the public domain points at the intended production service.Launch blocker

    How to verify

    1. Resolve the apex and any required subdomains from outside your local network.
    2. Confirm old deployment targets are no longer receiving production traffic.
    ICANN: the domain name system
  • Remove debug output and placeholder contentKeep test data, verbose logs, and unfinished copy out of production.

    How to verify

    1. Search the production build for TODO copy, sample records, and development-only banners.
    2. Review the browser console and server logs for unexpected debug output.
    OWASP: error handling
  • Add a useful 404 pageHelp people and crawlers recover when a URL does not exist.

    How to verify

    1. Visit a random URL that cannot exist on the production domain.
    2. Confirm the response is a real 404 and the page offers a useful next step.
    Google: HTTP and network errors

Search & discovery

Make important pages understandable and discoverable.

0 of 0 complete

  • Write unique titles and descriptionsGive every important page a clear search result and browser label.

    How to verify

    1. Inspect the title and meta description on each indexable page template.
    2. Confirm they describe the page specifically instead of repeating site-wide copy.
    Google: title links
  • Review robots and indexing directivesRemove accidental noindex rules and keep private routes out of search.Launch blocker

    How to verify

    1. Inspect robots.txt and the robots meta tag on the production response.
    2. Confirm public pages are indexable and private or duplicate routes are intentionally excluded.
    Google: robots meta rules
  • Generate and publish a sitemapList the canonical URLs you want search engines to discover.

    How to verify

    1. Open the production sitemap and confirm it returns valid XML.
    2. Check that it contains absolute canonical URLs and excludes private or broken pages.
    Google: build a sitemap
  • Verify canonical tags page by pagePrevent duplicate URL variants from competing in search.

    How to verify

    1. Inspect the canonical link in the initial HTML of each indexable template.
    2. Confirm it is absolute, valid, and points to the preferred version of that page.
    Google: canonical URLs
  • Check social sharing previewsControl how key pages appear when people share them.

    How to verify

    1. Confirm the title, description, URL, and image metadata use absolute production values.
    2. Paste a key URL into the preview debugger for the platforms you support.
    Open Graph protocol
  • Validate relevant structured dataDescribe eligible content without marking up information users cannot see.

    How to verify

    1. Run representative production pages through a structured-data validator.
    2. Fix syntax errors and confirm every marked-up value is visible on the page.
    Google: structured data

Performance

Keep the first visit fast and the interface responsive.

0 of 0 complete

  • Measure Core Web Vitals on productionTest loading, responsiveness, and visual stability on the real origin.

    How to verify

    1. Run representative pages through PageSpeed Insights or Chrome DevTools.
    2. Record LCP, INP, and CLS; investigate any metric outside the good range.
    web.dev: Core Web Vitals
  • Size and encode images for their displayAvoid shipping oversized pixels or causing layout shifts.

    How to verify

    1. Confirm responsive images provide appropriate source sizes and modern formats.
    2. Set intrinsic width and height so the browser reserves space before each image loads.
    web.dev: image performance
  • Review the JavaScript shipped on first loadKeep nonessential scripts out of the critical interaction path.

    How to verify

    1. Inspect the production network and coverage panels for unused or duplicated code.
    2. Defer third-party and route-specific scripts until they are actually needed.
    web.dev: optimize JavaScript
  • Set a deliberate cache policyCache fingerprinted assets aggressively without serving stale HTML forever.

    How to verify

    1. Inspect Cache-Control on HTML, static assets, API responses, and media.
    2. Confirm immutable fingerprinted files use long caching and update-sensitive responses do not.
    MDN: HTTP caching
  • Enable response compressionReduce transfer size for text assets such as HTML, CSS, JavaScript, and JSON.

    How to verify

    1. Inspect production responses for Brotli or gzip content encoding.
    2. Confirm already-compressed media is not recompressed unnecessarily.
    MDN: content encoding
  • Prevent fonts from blocking or shifting contentMake text immediately readable and keep layout stable during font loading.

    How to verify

    1. Load only the font files and weights used by the production interface.
    2. Use an appropriate font-display strategy and inspect for visible text reflow.
    web.dev: optimize web fonts

Accessibility

Make every critical path operable and understandable.

0 of 0 complete

  • Complete every critical flow with a keyboardEnsure controls work without a pointer and focus follows a useful order.Launch blocker

    How to verify

    1. Use only Tab, Shift+Tab, Enter, Space, Escape, and arrow keys where expected.
    2. Confirm every action is reachable, operable, and encountered in a logical order.
    W3C: keyboard access
  • Keep keyboard focus clearly visibleShow where interaction will happen without hiding focus behind sticky UI.

    How to verify

    1. Tab through the complete page at desktop and mobile widths.
    2. Confirm the focus indicator is high contrast, unobscured, and never clipped.
    W3C: focus visible
  • Label forms and explain errorsGive every input a persistent name and every error a useful recovery path.Launch blocker

    How to verify

    1. Confirm every field has a programmatic label and relevant instructions.
    2. Trigger each validation state and verify the message identifies the problem and next action.
    W3C: form labels
  • Write useful alternatives for meaningful imagesDescribe information and leave purely decorative images silent.

    How to verify

    1. Review every image, icon-only control, chart, and embedded visual.
    2. Provide equivalent text for meaning; use empty alt text for decoration.
    W3C: image accessibility
  • Check text and interface contrastKeep content readable and controls distinguishable in every state.

    How to verify

    1. Measure body text, muted text, focus indicators, controls, and status colors.
    2. Check default, hover, focus, active, disabled, error, and success states.
    WCAG 2.2: contrast
  • Test zoom, reflow, and target sizeKeep content usable when text grows or the viewport narrows.

    How to verify

    1. Zoom to 200% and test at a 320 CSS-pixel viewport without losing core actions.
    2. Confirm standalone controls have adequate target size and do not overlap.
    WCAG 2.2 standard

Security & privacy

Reduce common exposure before real traffic arrives.

0 of 0 complete

  • Remove insecure and mixed-content requestsLoad every production resource over HTTPS.Launch blocker

    How to verify

    1. Inspect the browser security and network panels on representative pages.
    2. Replace or remove every HTTP script, image, font, frame, and API request.
    MDN: content security policy
  • Keep secrets out of client code and logsAssume every browser-delivered value and public build artifact can be read.Launch blocker

    How to verify

    1. Search built assets, source maps, logs, and version history for credentials and private keys.
    2. Move privileged operations server-side and rotate anything that may have been exposed.
    OWASP: secrets management
  • Set relevant browser security headersAdd defense in depth for content loading, framing, and transport.

    How to verify

    1. Inspect production headers for CSP, HSTS, frame restrictions, and content-type protection.
    2. Start restrictive policies in report-only mode when rollout could break legitimate behavior.
    OWASP: secure headers
  • Protect authentication and session cookiesLimit when sensitive cookies are sent and whether scripts can read them.Launch blocker

    How to verify

    1. Inspect session cookies for Secure, HttpOnly, and an intentional SameSite value.
    2. Confirm domain, path, and expiration are no broader or longer than necessary.
    MDN: Set-Cookie
  • Audit production dependenciesRemove known vulnerable packages and software you no longer need.

    How to verify

    1. Run the ecosystem audit tool against the production lockfile and container image.
    2. Resolve high-impact findings or document a time-bound mitigation and owner.
    OWASP: dependency management
  • Protect state-changing requestsValidate authorization and prevent forged cross-site actions.

    How to verify

    1. Confirm every write operation checks authorization on the server.
    2. Use framework CSRF protections or appropriate tokens and SameSite cookie controls.
    OWASP: CSRF prevention

Monitoring & recovery

Know when production fails and how to recover safely.

0 of 0 complete

  • Capture production errors with release contextMake failures visible without exposing sensitive data.

    How to verify

    1. Trigger a controlled test error and confirm it reaches the production error system.
    2. Verify reports include the release identifier and exclude tokens, credentials, and personal data.
    OWASP: logging
  • Monitor the public service from outside itDetect availability failures before users have to report them.

    How to verify

    1. Create an external check for the public URL and one meaningful dependency or health endpoint.
    2. Send a test alert and confirm it reaches a person who can act on it.
    Google SRE: monitoring systems
  • Review logs for actionability and sensitive dataRecord useful operational events without storing secrets or unnecessary personal data.

    How to verify

    1. Trace one successful and one failed request through production logs.
    2. Confirm logs support diagnosis while masking sessions, tokens, passwords, and private payloads.
    OWASP: logging
  • Test backup restorationA backup is only useful when you can restore it within the required time.

    How to verify

    1. Restore a recent backup into an isolated environment using the documented process.
    2. Verify integrity, access controls, encryption, and the time required to recover.
    OWASP: backup and restore
  • Write and rehearse the rollback pathKnow who can stop a bad release and how to return to a known-good version.Launch blocker

    How to verify

    1. Identify the last known-good release and the exact command or control that restores it.
    2. Assign an owner and test the rollback in a safe environment before launch.
    Google SRE: release engineering

Specific enough to verify. Short enough to use.

Every check names an observable outcome, a short verification path, and a primary source. No vague advice and no account wall between you and a safer launch.

36production checks

15launch essentials

0accounts required