Launching a website is the moment when everything looks finished. It is also when the most expensive mistakes slip in, because they don’t show on the day. The site loads. It looks good. Everyone is happy. Three weeks later, you discover Google isn’t indexing it, or that form requests were landing in spam. Here is what we check before every launch, at the quality assurance stage, and why.
The domain and HTTPS
Your site should exist at a single address. With or without “www”, but not both: one redirects to the other. Same for HTTP, which always redirects to HTTPS. The certificate renews automatically, or it will expire on a Friday evening.
If the site replaces an old one, the switch is prepared a few days ahead: the time to live of the DNS records is lowered so the change propagates quickly. And the email records stay intact. A domain that changes servers must not take your mailboxes with it.
The checkbox that makes a site invisible
During development, the working copy of the site is hidden from search engines. In WordPress, it’s a checkbox in the Reading settings: “Discourage search engines from indexing this site”. It’s needed until launch. Forgotten after, it makes the site invisible in Google, without any error message.
It is the most common launch mistake, and the silliest. We check it twice: in the settings, then in the source code of the live home page, where no noindex tag must remain.
The old addresses
If the new site replaces an old one, every address that matters has to lead somewhere. The pages that get visits, the ones other sites link to, the ones your clients have bookmarked: each gets a permanent redirect (301) to its new page. Without it, Google and your visitors land on a 404 error, and the traffic of those pages disappears.
Redirects are tested before launch, then a second time right after, on the live site. Google recommends keeping them for at least a year. The details of the method are on our website redesign page.
Forms and emails
Every form is submitted for real, end to end. Does the message reach the right person? In the inbox, not in spam? Does the visitor get the expected confirmation, with the right text?
That test often reveals a problem. The site sends its emails straight from the server, and they are seen as suspicious. A specialized sending service, connected through an SMTP plugin, and the domain’s authentication records (SPF, DKIM) fix it. We cover that in our list of essential WordPress plugins.
Quebec’s Law 25, from the first visit
A site that collects personal information, even just through a contact form, must publish a privacy policy in clear and simple terms (section 8.2 of the Act respecting the protection of personal information in the private sector). It is online at launch, accessible from every page.
Analytics tools and ad pixels wait for the visitor’s choice. To check it, open the site in a private browsing window, without touching the consent banner. The Network tab of the browser’s developer tools lists everything the page sends. Nothing should be going out to Google or to an ad network yet. Some Google settings get around this without warning, as we explain in our article on Google Tag Manager.
Analytics and Search Console
Once consent is given, the analytics tools have to work. We check that Google Analytics receives the visits and that conversions (a request sent, a purchase) come through as expected. A site launched without reliable measurement means a first month of data lost.
The site is then added to Google Search Console. The sitemap is submitted, and indexing of the main pages is requested. That is also where Google will flag, in the following weeks, the pages it can’t read.
Speed, devices and accessibility
The site is tested on real phones, not just in a narrowed browser window. The main pages go through a speed test, like our free test, to catch a forgotten five-megabyte image. And we go through the site with the keyboard, no mouse: every link and every button must be reachable, with a visible outline. Contrast and image alt text get checked along the way.
Accounts in your name
On launch day, every account must belong to the business: domain name, hosting, Google Analytics, Search Console, Tag Manager, Cloudflare if there is one. Your provider has access as a guest. The day you change providers, you have nothing to recover.
The checklist for launching a website
Here is our checklist, to print or copy:
- A single address for the site, HTTPS everywhere, certificate renewed automatically.
- Email records intact after the switch.
- “Discourage search engines” box unchecked, no
noindextag in the code. - A 301 redirect for every old address that matters, tested before and after.
- Every form submitted for real, emails received somewhere other than spam.
- Privacy policy published, no tracking before consent.
- Google Analytics and conversions checked after consent.
- Site added to Search Console, sitemap submitted.
- Tests on phone, with the keyboard and for speed.
- All accounts in the business’s name.
The first weeks after launch
Launch isn’t the end. It’s the start of the period when quiet problems surface.
In the days that follow, Search Console starts flagging what Google can’t read: a page in error, a redirect going in circles, a page excluded by mistake. A fresh full crawl of the site catches the broken links nobody noticed. Visit statistics show whether a popular old page now leads to an error.
It is also the time to check that the routine runs: the first automatic backup exists and can be restored, monitoring alerts you if the site goes down, and forms still receive real requests.
Nothing spectacular. But that’s where a successful launch differs from a lucky one. Our maintenance plans take over once the site is live.
