Website launch checklist (25 checks)

Before you launch, check that your website can be found, shared, trusted and read. That means a title, description and single H1 on every page, a sitemap and robots.txt that let search engines and AI crawlers in, a share image that shows when someone posts your link, HTTPS with security headers, SPF, DKIM and DMARC for your email, and no broken links on the pages people will visit. The 25 checks below cover each of these in order.

Why check the site before a launch?

A launch sends more people to your site in a day than it may see in a month. Every visitor, and every search engine, AI assistant and social network that reads your pages that day, gets one first impression. A missing share image, a stray noindex left over from staging or launch emails landing in spam can quietly waste the attention you worked for. Most of these problems take minutes to fix once you know they're there.

Is your site findable by search engines?

1. Every page has a title. Put what the page is about first, since Google trims long titles in its results.
2. Every page has a meta description. One or two sentences that say what the page offers. Google doesn't always use it, but a clear one is used more often.
3. One H1 per page. The H1 is the page's main heading. It should match what the title promises.
4. A canonical URL. Each page names its own preferred address, so www and non-www, or a URL with tracking parameters, don't compete as duplicates.
5. No leftover noindex. Staging sites are often set to noindex to keep them out of search. Check that the setting didn't ship to production, in the page or in an X-Robots-Tag header.
6. A sitemap, named in robots.txt. List the pages you want indexed in sitemap.xml, and add a Sitemap: line to robots.txt so search engines find it.
7. robots.txt doesn't block what matters. Make sure no Disallow rule covers your homepage, pricing or docs.
8. Structured data. A JSON-LD block that describes your organization and your product (SoftwareApplication or Product) helps search engines understand what you make.

Will your link look right when it's shared?

9. Open Graph title and description. og:title and og:description decide the text on the card a shared link shows on LinkedIn, Facebook, Slack and others.
10. A share image at 1200 × 630 pixels. Set og:image to an absolute URL anyone can load, at about 1.91:1. Without it, many platforms show a card with no image at all.
11. An X card type. twitter:card set to summary_large_image makes X show the large image instead of a small thumbnail.
12. A favicon and an Apple touch icon. A 32 × 32 favicon (or an SVG) and a 180 × 180 Apple touch icon cover browsers and phones, and many sites and apps use them as your logo.

If the share image is the problem, our guide to why a link preview shows no image goes through each cause.

Can visitors and inboxes trust it?

13. HTTPS everywhere. Plain http:// should redirect to https:// in one hop.
14. A certificate that renews itself. Since March 15, 2026, publicly trusted TLS certificates can be valid for at most 200 days, falling further in 2027 and 2029 under the CA/Browser Forum's ballot SC-081. Automatic renewal is no longer optional.
15. HSTS. A Strict-Transport-Security header tells browsers to use HTTPS for your site every time.
16. The other security headers. A Content-Security-Policy, clickjacking protection (frame-ancestors or X-Frame-Options), X-Content-Type-Options: nosniff and a Referrer-Policy. A missing header isn't a breach, but each one closes off a class of attack.
17. SPF. One SPF record listing every service that sends mail as your domain.
18. DKIM. Signing records from each of those services.
19. DMARC. A DMARC record, starting at p=none with reports, so receivers can tie your mail to your domain. Gmail, Yahoo and Outlook.com require all three from bulk senders, and our SPF, DKIM and DMARC guide explains them.
20. A way to reach you, and a privacy policy. A contact address and the policies people expect build trust, and you may be legally required to publish a privacy policy if you collect personal data.

Can AI assistants read it?

21. AI search crawlers are allowed. Check robots.txt and your CDN's bot settings for rules that block OAI-SearchBot, Claude-SearchBot or PerplexityBot. Blocking training crawlers is your choice; blocking search crawlers keeps you out of AI answers.
22. Your content is in the HTML. Most AI crawlers don't run JavaScript. If your page builds its text in the browser, render the key pages on the server.
23. A clear answer near the top. Your homepage should say in one or two sentences what the product is and who it's for. That's the line an assistant, and a visitor, will quote.

Is it healthy?

24. No broken links on key pages. Check the homepage, pricing, sign-up and any post you'll share for links that answer 404 or a server error.
25. No redirect chains. Link straight to final addresses, and make sure http, https, www and non-www each reach your canonical address in a single redirect.

What about launch day itself?

Once the site passes, the remaining work is the launch plan, not the website:

Decide where you'll launch, and space those places out over a few weeks rather than one day.
Prepare your listing copy, screenshots and a short description you can reuse.
Tell the people who asked to hear from you first: your waitlist, your users and your communities.
Be around to answer questions and comments on the day.
Re-run these checks after any redesign, migration or major release.

Run them all at once

You don't have to check 25 things by hand. These free tools need no sign-up:

The website grader gives one grade for the whole site across four parts: found on Google (on-page SEO, structured data and the sitemap), quoted by AI (AI crawler access, llms.txt and how easy the page is to quote), shared well (the card X, LinkedIn, Facebook and Slack show) and safe to visit (HTTPS and security headers), with the fixes that matter most first.
The launch checklist lists everything a product's website needs before launch day, in order, with the free tool that checks each step, then the steps for launch day and after.
The SEO checker audits a single page: title and meta description length, one H1, a canonical URL and language, any noindex, Open Graph tags, structured data, images without alt text and how much readable text there is.

When it all passes, list your product on MakerRadar.