Website launch readiness

The twelve checks between “it works” and “it is ready.”

A launch-ready website can be found, quoted, shared, trusted, contacted, and used safely. The build can work perfectly while any one of those layers is missing. This checklist covers the evidence to inspect before you announce.

Audit a live siteFree · no account required

What is website launch readiness?

Website launch readiness is the state in which a deployed product has the technical, discovery, trust, compliance, delivery, and conversion layers required to reach its intended audience and support a real launch. It is broader than technical SEO and narrower than a product strategy review.

Discoverability

robots.txt, sitemap, canonical URLs, broken internal links, redirect chains, and the accidental noindex that keeps a finished site out of every index.

Evidence to collect: Fetch robots.txt and sitemap.xml, then inspect canonical, indexability and internal-link responses from the deployed host.
Common launch failure: A production noindex, missing sitemap entry or redirect chain can keep a finished page out of search entirely.
First move: Remove accidental blocks first, then make one canonical, crawlable URL the source of truth for every page.

AI visibility

Whether GPTBot, ClaudeBot, PerplexityBot and Google-Extended can reach you, whether your content exists without JavaScript, and whether it is shaped to be quoted.

Evidence to collect: Read crawler directives for major answer engines and compare the server-rendered HTML with the content a visitor sees.
Common launch failure: The copy exists in the browser but not in the response, or AI crawlers are blocked by a copied robots template.
First move: Expose the core answer in server HTML and allow only the crawler access that matches your distribution policy.

Compliance

Privacy policy, Impressum, consent before tracking, Google Fonts from a CDN, California opt-out, withdrawal rights. Detection, never legal advice.

Evidence to collect: Open the privacy, imprint and withdrawal routes, then inspect whether analytics or marketing requests fire before consent.
Common launch failure: A linked policy is missing, regionally required operator details are absent, or tracking starts before the visitor chooses.
First move: Fix observable consent ordering and page reachability, then have jurisdiction-specific text reviewed by qualified counsel.

Email deliverability

SPF, DKIM, DMARC and MX. You launch, you send a welcome email, it lands in spam — and nothing tells you.

Evidence to collect: Query MX, SPF and DMARC records and verify the DKIM selector used by the sending provider.
Common launch failure: Mail can be sent from the app but the domain does not authorize or authenticate it, so welcome messages land in spam.
First move: Publish the provider's SPF and DKIM values, add a reporting DMARC policy, then tighten it after monitoring.

Metadata

Titles and descriptions per page, duplicates across pages, and the scaffolding titles that survive to production.

Evidence to collect: Compare each indexable page's title, meta description, canonical and language with its actual page purpose.
Common launch failure: Scaffold titles, duplicate descriptions and one canonical copied across every route survive into production.
First move: Give the highest-intent routes unique titles and descriptions before expanding to lower-value pages.

Structured data

JSON-LD presence, the type you declared, and whether its required properties are filled.

Evidence to collect: Parse every JSON-LD block and compare required properties with content that is visibly present on the page.
Common launch failure: Markup names the wrong entity, omits required fields or claims prices and content the visitor cannot verify.
First move: Keep one accurate primary entity, source its values from page data, and remove unsupported claims.

Security

HSTS, CSP, cookie flags, mixed content, subresource integrity and outdated libraries. Read from headers, never by probing.

Evidence to collect: Inspect response headers, cookie attributes, mixed-content references and third-party script integrity without probing private paths.
Common launch failure: A secure page still permits framing, sends session cookies without protection or loads active content over HTTP.
First move: Protect authentication cookies and eliminate mixed content first, then harden browser policy headers.

Accessibility

Alt text, form labels, disabled zoom, heading order and landmarks — plus the EU accessibility statement in force since June 2025.

Evidence to collect: Inspect document landmarks, heading order, image alternatives, form labels and viewport settings in the returned markup.
Common launch failure: Controls look labeled but have no accessible name, headings skip the page structure or zoom is disabled.
First move: Repair names, labels and semantic structure before treating automated checks as a complete accessibility review.

Performance

Compression, render-blocking scripts, images without dimensions, legacy formats and document weight. Causes, not guessed metrics.

Evidence to collect: Measure document weight and compression, then identify render-blocking scripts and images missing dimensions.
Common launch failure: The page waits on avoidable script work, ships uncompressed text or moves during image loading.
First move: Remove blocking work on the critical path and declare media dimensions; use field data for Core Web Vitals.

Conversion

Email capture, a contact route, analytics, a visible price and social proof. Advisory rather than scored hard.

Evidence to collect: Follow the primary visitor path and verify that the action, price or contact route is visible and measurable.
Common launch failure: The page explains the product but leaves the visitor without a credible next action or a way to reach the operator.
First move: Name one primary action in the visitor's language and keep its label consistent through completion.

Basics

HTTPS, certificate expiry and host coverage, TLS version, redirects, real 404s, domain expiry and time to first byte.

Evidence to collect: Check HTTPS redirect behavior, certificate coverage and expiry, real 404 responses, domain expiry and server response time.
Common launch failure: One host variant stays on HTTP, the certificate misses a hostname or unknown routes return a branded 200 page.
First move: Make every public host converge on one HTTPS origin and return honest status codes before launch traffic arrives.