Website launch checklist

Address and security

• Your domain loads the site with and without www, and both end up at the same address. www or not?
• Every page loads on https:// with a padlock, and http:// redirects to it. Force HTTPS
• No “not fully secure” warnings: images and scripts load over https too. Mixed content
• Admin passwords are long and unique, and stored in a password manager. Strong passwords
• Default or test accounts, sample pages and “Hello world” posts are deleted.

Content

• The home page says, in one sentence, what the site is and who it’s for.
• Every example or placeholder text is replaced, including “Lorem ipsum” and example.com addresses.
• Contact details are correct, and the contact link or form has been tested by sending yourself a message.
• Every page has been read once, out loud, for typos.
• Every link has been clicked, including the menu and the footer.
• A custom 404 page helps lost visitors find their way. Custom error pages

Email and legal basics

• You can send and receive email on your own domain, and messages don’t land in spam. SPF, DKIM and DMARC
• Forms and WordPress send email through a real mailbox, using SMTP. Make WordPress emails arrive
• There’s a privacy notice if you collect any personal data. A contact form or comments count.
• If you use non-essential cookies (analytics, adverts, embeds that track), visitors are asked first.
• Businesses show who they are. A limited company must show its registered name, number and office address.

Speed and safety

• Images are resized for the web (usually 2000 pixels wide or less) before uploading. Image optimisation
• Caching is on. WordPress on Traxio: the LiteSpeed Cache plugin. What is caching?
• The home page loads in a few seconds on a phone connection. Measure website speed
• A full backup has been downloaded to your computer, and you know how to restore it. Take a full backup
• There’s a plan for updates: who checks, and how often (every week or two for WordPress). Keep software updated