---
name: website-launch-checklist
description: Audit a marketing website before launch and produce a prioritised checklist — SEO surfaces, structured data, PWA, consent, performance, accessibility, security headers, analytics, legal pages. Use when asked "is the site ready to launch", "what's missing on the website", or to run a pre-launch review of a React/Vite/Next site.
---

# Website launch checklist

Run the checks, then report a table: item · status (✅/⚠️/❌) · fix. Lead with the ❌ items that block launch.

## Discoverability
- `robots.txt` (allow crawl, disallow `/api/`), `sitemap.xml` with every public route including posts.
- Unique `<title>` and meta description per route; canonical URLs; Open Graph + Twitter cards with a real image.
- Structured data: `Organization`, `WebSite`, `Service`/`Product`, `FAQPage`, `Article` for posts — validated with the Rich Results test.
- SPA? Prerender routes to static HTML (or SSR) so crawlers and link previews see content.
- An `llms.txt` and clean, quotable page copy for AI answer engines.

## Trust & legal
- Privacy policy, terms, imprint/contact; mention camera/microphone if any feature uses them.
- Cookie consent wired to Consent Mode v2 *before* tags load; default denied in the EU.
- Working contact path (email + phone), reply-time promise that is true.

## Performance
- Lighthouse ≥ 90 mobile: images as WebP/AVIF with dimensions, video `preload="metadata"` + faststart, fonts `display=swap` and preloaded, heavy 3D/shader code lazy-loaded, no layout shift on hero.
- Cache headers: immutable for hashed assets, `no-cache` for `sw.js`.

## App-like
- Web manifest (name, icons 192/512 + maskable, theme colour), service worker with sensible runtime caching, install prompt handled, offline fallback for the shell.
- Favicons: 32/48/192 PNG + `.ico` + SVG; the mark should fill ≥ 85% of the canvas.

## Accessibility
- Keyboard reachable nav, visible focus, `aria-label`s on icon buttons, `prefers-reduced-motion` respected, colour contrast ≥ 4.5:1 for text in both themes, skip link.

## Security
- Headers: `Content-Security-Policy` (at least frame-ancestors + object-src), `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy` (camera only where used), HTTPS everywhere.
- No secrets in the client bundle; API routes rate-limited; forms protected against spam.

## Operations
- Analytics + error monitoring live; 404 page with navigation; README with run/deploy steps; environment variables documented in `.env.example`; a changelog or progress log.