My pre-launch checklist for WordPress sites
Most launch-day problems aren’t difficult. They’re forgotten. A site that stays hidden from Google for a month because one box was ticked. A contact form that sends to a developer’s test inbox. Old URLs that now return 404 and lose years of search traffic. This WordPress launch checklist is what I work through before a site goes live.
Search visibility
- Settings → Reading: untick “Discourage search engines”. Development sites should have it ticked; live sites must not.
- HTTPS everywhere:
http://andwww.variants should 301 to one canonical address. - XML sitemap generated and reachable.
robots.txtdoesn’t block CSS, JS or content. - Redirects from the old site. Crawl the old site or export its URLs from Search Console, and map every page with traffic or links to its new address.
- Each page has a unique title and meta description. Thin or placeholder pages are noindexed or removed.
- Submit the sitemap in Google Search Console and Bing Webmaster Tools.
Content
- No placeholder text, test posts or “Sample Page”. Search the database for “lorem”.
- Favicon and site icon set. Default social sharing image set, 1200 × 630.
- Privacy policy published and linked, especially if you add analytics.
- A useful 404 page that links to the main sections, returning a real 404 status.
Forms and email
- Submit every form and confirm the email arrives, at the client’s real address.
- Configure SMTP or a transactional mail service. PHP mail from shared hosting often lands in spam.
- Spam protection on forms and, if comments are open, on comments.
Performance
- Page caching on. Images sized and served as WebP. Theme assets versioned so caches refresh.
- Run Lighthouse on the homepage and one of each template. I care most about real-visitor Core Web Vitals, so I recheck them in Search Console a month after launch.
Accessibility
- Keyboard through the main pages: visible focus, a working skip link, a menu that opens and closes with Escape.
- Colour contrast in every colour mode. Alt text on meaningful images.
- My accessibility checklist has the full version.
Security and recovery
- Admin usernames and passwords changed from anything used during development. Two-factor login on.
- Development and staging copies removed from the live server, or password protected.
- Automatic backups running and stored off the server. Do one manual backup right before launch.
- The rest of my security checklist.
Tracking
- Analytics installed, excluding logged-in users so your own visits don’t count.
- Search Console verified for the domain.
- An uptime monitor that emails or messages you if the site goes down.
After launch
Check the site again the next day and a week later: error logs, Search Console coverage, form submissions and the 404 log. Launch is when real visitors start finding the things testing missed.