Website launch checklist
Run the checks, then report a table: item · status (✅/⚠️/❌) · fix. Lead with the ❌ items that block launch.
Discoverability
robots.txt(allow crawl, disallow/api/),sitemap.xmlwith every public route including posts.- Unique
<title>and meta description per route; canonical URLs; Open Graph + Twitter cards with a real image. - Structured data:
Organization,WebSite,Service/Product,FAQPage,Articlefor posts — validated with the Rich Results test. - SPA? Prerender routes to static HTML (or SSR) so crawlers and link previews see content.
- An
llms.txtand clean, quotable page copy for AI answer engines.
Trust & legal
- Privacy policy, terms, imprint/contact; mention camera/microphone if any feature uses them.
- Cookie consent wired to Consent Mode v2 before tags load; default denied in the EU.
- Working contact path (email + phone), reply-time promise that is true.
Performance
- Lighthouse ≥ 90 mobile: images as WebP/AVIF with dimensions, video
preload="metadata"+ faststart, fontsdisplay=swapand preloaded, heavy 3D/shader code lazy-loaded, no layout shift on hero. - Cache headers: immutable for hashed assets,
no-cacheforsw.js.
App-like
- Web manifest (name, icons 192/512 + maskable, theme colour), service worker with sensible runtime caching, install prompt handled, offline fallback for the shell.
- Favicons: 32/48/192 PNG +
.ico+ SVG; the mark should fill ≥ 85% of the canvas.
Accessibility
- Keyboard reachable nav, visible focus,
aria-labels on icon buttons,prefers-reduced-motionrespected, colour contrast ≥ 4.5:1 for text in both themes, skip link.
Security
- Headers:
Content-Security-Policy(at least frame-ancestors + object-src),X-Content-Type-Options,Referrer-Policy,Permissions-Policy(camera only where used), HTTPS everywhere. - No secrets in the client bundle; API routes rate-limited; forms protected against spam.
Operations
- Analytics + error monitoring live; 404 page with navigation; README with run/deploy steps; environment variables documented in
.env.example; a changelog or progress log.