Things to Note Before Launching a Website: The Ultimate Pre-Launch Checklist

1. UI/UX and mobile responsiveness

Your website should work seamlessly across different screen sizes, browsers, and devices. A layout that looks perfect on your laptop may be difficult to use on a mobile phone.

Before launching, check the following:

• Remove horizontal scrolling across all screen sizes.
• Fix mobile overflow and overlapping elements.
• Add a functional mobile navigation menu.
• Ensure every page is optimized for mobile devices.
• Test the website on a low-end Android phone.
• Make the logo clickable and link it to the homepage.
• Remove unused navigation items.
• Remove all placeholder text and unfinished content.
• Fix broken buttons and non-functional interactions.
• Add a favicon.
• Fix the copyright year.
• Create a professional 404 page for missing pages.
• Create a 500 error page for server errors.

Remember: Responsive design is not just about making elements smaller. It is about ensuring the website remains usable on every device.

2. Links, buttons and website functionality

Every visible interactive element should perform the action users expect.

• Find and fix broken internal and external links.
• Check every link in the footer.
• Make phone numbers clickable using tel:.
• Make email addresses clickable using mailto:.
• Test every button and call to action.
• Add success messages after completed actions.
• Add clear error messages when something fails.
• Test forms, dropdowns, menus and other interactive components.
• Ensure users can contact you through a working contact method.
• Verify that all navigation items lead to the correct destinations.

Never leave buttons that look functional but do nothing when clicked.

3. SEO and social media metadata

Search engines and social platforms need accurate information about your website and its pages.

Before launch:

• Give every important page a unique, descriptive title.
• Add relevant meta descriptions.
• Configure appropriate meta tags.
• Add Open Graph metadata and an OG image for attractive link previews on X and other platforms.
• Set canonical URLs where appropriate.
• Check that important pages can be indexed.
• Generate an XML sitemap.
• Configure robots.txt correctly.
• Fix broken links and avoid unnecessary redirect chains.

SEO is not a guarantee of rankings, but getting the technical foundations right makes your website easier for search engines to understand.

4. Website speed and performance

Slow websites frustrate users and can hurt conversions. Performance should be tested before launch, not after complaints begin.

• Compress and optimize images.
• Use WebP or AVIF where appropriate.
• Remove unused JavaScript, CSS and dependencies.
• Optimize font loading.
• Lazy-load non-critical images.
• Configure caching and compression.
• Test the website on slow mobile connections.
• Measure Core Web Vitals.
• Investigate pages and actions that take more than three seconds to load.
• Check whether third-party scripts are slowing down the website.

Do not assume a website is fast simply because it loads quickly on your own computer.

5. API keys, environment variables and secrets

One of the most important security rules is simple: never expose private API keys or credentials in frontend code.

• Keep private API keys on the server.
• Store secrets in environment variables or a secrets manager.
• Never commit secrets to Git.
• Rotate any credentials that have been exposed or committed to a repository.
• Remove exposed secrets from Git history where necessary.
• Add secret-containing environment files to .gitignore.
• Use separate credentials for development and production.
• Review deployment environment variables.
• Never expose privileged database credentials or service-role keys in client-side code.
• Use public database keys only when the platform is designed for them and appropriate access policies are enforced.

Removing a key from your code is not enough if it has already been exposed. Revoke or rotate it first.

6. Authentication, authorization and database security

A hidden dashboard or a protected-looking button does not make an application secure.

• Enforce authentication on the server for every protected route and API endpoint.
• Verify authorization for every sensitive operation.
• Configure row-level security where supported.
• Restrict database access according to user ownership and permissions.
• Prevent users from changing protected fields such as account roles or ownership IDs.
• Secure session cookies using appropriate HttpOnly, Secure and SameSite settings.
• Hash passwords using an appropriate password-hashing algorithm.
• Encrypt sensitive data in transit and at rest where appropriate.
• Configure session expiration and token revocation.
• Rate-limit login, signup and password-reset endpoints.
• Add bot protection where it makes sense.

Always test access using different user accounts. A normal user should never be able to access another user's private records simply by changing an ID in a URL or API request.

7. Input validation and error handling

Never trust input just because it comes from your own website's interface.

• Validate all inputs on the server.
• Use parameterized queries or safe ORM methods.
• Safely render user-generated content to prevent cross-site scripting.
• Restrict file uploads by type, size and content.
• Prevent unauthorized field updates and mass assignment.
• Return only the API data each user is authorized to access.
• Use appropriate HTTP status codes.
• Prevent error messages from exposing stack traces, database details or credentials.
• Configure security headers, including an appropriate Content Security Policy.
• Enforce HTTPS.
• Review CORS settings.

Frontend validation improves the user experience, but server-side validation is essential for security.

8. Rate limiting and AI API cost control

If your website uses AI models or paid third-party APIs, uncontrolled usage can become expensive very quickly.

• Add rate limits to expensive endpoints.
• Set spending limits or budget alerts with your AI provider where available.
• Configure usage quotas.
• Limit request sizes, token counts and concurrency.
• Set sensible timeouts.
• Cache repeated requests where appropriate.
• Monitor API usage and costs.
• Keep privileged API calls on the server.
• Detect suspicious usage patterns.
• Configure alerts for unusual spikes in requests or spending.

Do not assume that a paid AI subscription covers API usage. Subscription access and API billing can be separate.

9. Monitoring, backups and recovery

A website is not ready for production if you have no way to detect failures or recover from them.

• Set up application error tracking.
• Configure uptime monitoring.
• Add alerts for critical failures.
• Avoid logging passwords, access tokens and unnecessary personal information.
• Back up the database regularly.
• Test restoring a backup.
• Define backup retention periods.
• Document your recovery objectives.
• Prepare a rollback plan for failed deployments.
• Test the rollback procedure.
• Scan dependencies for known vulnerabilities.

A backup that has never been restored is an unverified recovery plan.

10. Legal compliance and user privacy

Legal requirements depend on your jurisdiction, your audience and how your website operates. Do not copy legal documents from another website without checking whether they apply to your business.

Review the following:

• Publish an accurate privacy policy.
• Publish appropriate terms of service.
• Implement age restrictions or age verification where legally required.
• Review third-party fonts and consider self-hosting them where practical.
• Disable unnecessary session-replay tools or configure appropriate consent and input masking.
• Review analytics and tracking technologies for applicable consent requirements.
• Include an unsubscribe link in marketing emails.
• Include required sender identification and postal address information in marketing emails.
• Display subscription prices, billing frequency, renewal terms and cancellation conditions clearly beside the subscribe button.
• Provide appropriate processes for privacy requests and data deletion.
• Review applicable privacy, consumer-protection and anti-spam laws.

11. Email deliverability

Your website may work perfectly while its emails end up in spam folders.

Before launch:

• Test account verification emails.
• Test password-reset emails.
• Test transactional emails and payment receipts.
• Configure SPF, DKIM and DMARC.
• Verify your sending domain.
• Test delivery across major email providers.
• Include appropriate unsubscribe functionality in marketing emails.
• Monitor bounced emails and spam complaints.
• Prevent duplicate emails when requests are retried.

Email functionality should be tested from beginning to end, including the actual delivery to a recipient's inbox.

12. Analytics and conversion tracking

Launching a website without analytics makes it harder to understand how people use it.

• Configure an analytics platform.
• Track important events such as signup, login, checkout and form submissions.
• Identify where users abandon important journeys.
• Monitor failed transactions and form errors.
• Configure privacy controls and consent where required.
• Exclude sensitive information from analytics events.
• Verify that events are recorded accurately.
• Establish baseline performance and conversion metrics.

Collect only the data you need and handle it responsibly.

13. End-to-end testing

Test the website as an actual user would experience it.

• Test signup and account verification.
• Test login and logout.
• Test password recovery.
• Test payment success and failure.
• Test subscription cancellation and renewal where applicable.
• Verify permissions for different user roles.
• Test file uploads and downloads.
• Check mobile, tablet and desktop layouts.
• Test keyboard navigation and accessibility.
• Check browser console errors and failed network requests.
• Test critical user journeys in the production environment.
• Confirm that the production build does not expose secrets or debug information.

Do not test only the happy path. Failed payments, invalid forms, expired sessions and unauthorized requests should also be tested.

14. Final deployment checklist

Before making your website publicly available:

• Verify all production environment variables.
• Confirm HTTPS and domain configuration.
• Run security and dependency checks.
• Apply database migrations safely.
• Verify that backups work.
• Confirm monitoring and alerts are active.
• Prepare and test your rollback plan.
• Check all critical pages and API endpoints.
• Test signup, payments and password recovery in production.
• Record the deployed version and any known issues.

Run this checklist with AI

Copy this prompt into Claude Code, Cursor or another AI coding assistant, opened in your project, and fill in the “About my site” part. It goes through all 14 sections, points to the exact files and pages that need work and waits for your approval before changing anything.

You are reviewing my website before launch. Do not change any code yet. Inspect the project first, then report.

About my site (fill this in):
- What it is (portfolio, business site, store, SaaS, web app):
- Stack and hosting:
- Does it have user accounts, payments, forms or AI features? (list them)
- Live or staging URL (if any):

Go through this pre-launch checklist:

1. UI/UX and mobile: no horizontal scrolling, no overflowing or overlapping elements, working mobile menu, readable text and tap targets, consistent layout across screen sizes.
2. Links and functionality: broken links, buttons that do nothing, forms that fail, missing 404 page, placeholder text or "#" links left in.
3. SEO and social metadata: unique titles and descriptions, Open Graph and Twitter images, favicon, sitemap.xml, robots.txt, canonical URLs, alt text, one H1 per page.
4. Speed and performance: image sizes and formats, lazy loading, unused JavaScript and CSS, font loading, caching headers, anything that would hurt Core Web Vitals.
5. Secrets: API keys or passwords in frontend code, public environment variables (NEXT_PUBLIC_, VITE_) holding secrets, .env files or keys committed to git.
6. Authentication and database security: every protected route and API checked on the server, users unable to access other users' data by changing an ID, admin actions restricted to admins, database rules (Supabase RLS, Firebase rules) enabled.
7. Input validation and errors: server-side validation on every form and API, safe error messages (no stack traces or internal details), SQL injection and XSS risks.
8. Rate limiting and AI cost control: limits on login, signup, contact forms and AI endpoints, spending caps or usage limits on paid APIs.
9. Monitoring, backups and recovery: error tracking, uptime monitoring, database backups and whether a restore has been tested.
10. Legal and privacy: privacy policy, terms, cookie consent where required, what personal data is collected and where it goes.
11. Email: SPF, DKIM and DMARC for the sending domain, transactional emails landing in the inbox, working reply-to address.
12. Analytics: analytics installed and respecting consent, key conversions (sign-ups, purchases, form submissions) tracked.
13. End-to-end testing: sign-up, login, password reset, checkout and other critical journeys, including failure cases (wrong password, failed payment, expired session).
14. Final deployment: production environment variables, HTTPS and domain setup, dependency and security checks, migrations, rollback plan.

For every issue, give:
- Checklist section and a one-line title
- Severity: Must fix before launch / Should fix soon / Nice to have
- Evidence: file path and line, page URL or endpoint
- The smallest fix

Rules:
- Only report what you can confirm. List anything you can't check from the code (for example email DNS records or hosting settings) under "Check manually", with how to check it.
- Mark sections that don't apply to this site as "Not applicable".

Finish with a table of all 14 sections (Ready / Needs work / Not applicable / Check manually), then the "must fix before launch" items in the order I should do them.

Wait for my approval before changing any code.