Website launch checklist: what to check before, on and after launch day

Use this as the pass you run on the production domain, not on staging. Each row says why the item matters, how to check it in a few minutes, and whose documentation it comes from. The details follow in the sections below.

#	Item	Why it matters	How to check	Source
1	No leftover noindex	Google drops a page with noindex "entirely from Google Search results"	View source on the live homepage and a few inner pages; look for a robots meta tag with noindex and for an X-Robots-Tag response header	Google Search Central
2	robots.txt does not block the site	Blocked pages cannot be crawled, and a block also hides any noindex rule from the crawler	Open /robots.txt on the live domain and look for a Disallow: / under User-agent: *	Google Search Central
3	Staging is not public	Google lists a demo version "accidentally left accessible to crawlers" as a source of duplicate content	Open the staging URL in a private window; it should ask for a password	Google Search Central
4	HTTPS everywhere	HTTPS protects integrity and is required for many newer browser features	Load the http:// address and confirm it redirects to https://; run Qualys SSL Server Test and aim for A or A+	web.dev
5	Old URLs redirect (relaunches only)	A permanent redirect sends people and Google to the new page	Request a few old URLs and confirm a 301 or 308 to the matching new page	Google Search Central
6	One canonical URL per page	Canonical tags tell Google which duplicate to show	Each page has one rel="canonical" with an absolute https URL pointing to itself	Google Search Central
7	Real 404s	Googlebot reads status codes to know a page does not exist	Visit a made-up path and confirm the response code is 404, not 200	Google Search Central
8	Unique titles and descriptions	Titles are often what people use to decide which result to click	No page is titled just "Home"; no two pages share a meta description	Google Search Central
9	Favicon	Google can show it next to your site in search results	Square, at least 8x8px, Google recommends larger than 48x48px, linked from the homepage	Google Search Central
10	Share preview tags	Links pasted into social apps and chats use Open Graph tags	og:title, og:type, og:image and og:url present on every page	Open Graph protocol
11	XML sitemap	Helps a new site with few links get found	/sitemap.xml lists only live, canonical URLs; one file holds at most 50,000 URLs or 50MB uncompressed	Google Search Central
12	Search Console verified	You need it to submit the sitemap and inspect URLs	A Domain property verified by DNS covers http, https and all subdomains	Google Search Console Help
13	Analytics installed	You need a baseline before you announce	Open your own site and see yourself in the GA4 Realtime report or DebugView	Google Analytics Help
14	Privacy policy (if you use analytics)	The Google Analytics terms require one	A visible privacy policy that discloses cookies and Google Analytics	Google Analytics Terms
15	Core Web Vitals	Google's thresholds for a good page experience	LCP within 2.5 seconds, INP 200 milliseconds or less, CLS 0.1 or less, at the 75th percentile	web.dev
16	Accessibility basics	Many visitors depend on them, and they are quick to check	Alt text, page titles, headings, color contrast of at least 4.5:1 for normal text, visible keyboard focus, page language, zoom, form labels	W3C WAI
17	Links and forms work	A broken signup form wastes the launch	Click every navigation link and submit every form on the live domain, including on a phone	Our own step

Most launch problems that cost search traffic come from settings that were right on staging and wrong in production.

Remove the staging noindex. Google's documentation describes noindex as a rule set "with either a tag or HTTP response header," and when Googlebot finds it, "Google will drop that page entirely from Google Search results, regardless of whether other sites link to it." If your builder or host adds it to preview builds, it can follow you to production. Check both places: the page source for a robots meta tag, and the response headers for X-Robots-Tag, because the header version is invisible in the HTML.

Do not rely on robots.txt to hide anything. Google says a robots.txt file "is not a mechanism for keeping a web page out of Google" and that to keep a page out you should "block indexing with noindex or password-protect the page." The two also conflict: if a page is blocked by robots.txt, "the crawler will never see the noindex rule, and the page can still appear in search results, for example if other pages link to it." On launch day the production robots.txt should not contain a blanket Disallow: / for all user agents. You can add a line that points to your sitemap; Google says it will find it "the next time we crawl your robots.txt file."

Lock staging with a password. For private content Google's advice is that "you need to password protect it to ensure only authorized users can access it." That also keeps the staging copy from competing with production: Google's canonicalization page lists "the demo version of the site is accidentally left accessible to crawlers" as one cause of duplicate URLs.

Set canonicals and redirects. Google ranks the ways to state a preferred URL by strength: redirects and rel="canonical" annotations are strong signals, sitemap inclusion is a weak one, and in all cases "indicating a canonical preference is a hint, not a rule." Use absolute URLs in the canonical tag; Google says relative paths can cause problems "if you unintentionally allow your testing site to be crawled." If you are replacing an older site, map every old URL to its new home with a permanent redirect. Google says "the 301 and 308 status codes mean that a page has permanently moved to a new location."

Return real status codes. Request a made-up URL and check the status code. Google's JavaScript guide asks for "a meaningful status code, like a 404 for a page that could not be found or a 401 code for pages behind a login."

Publish a sitemap. Google says a site with "about 500 pages or fewer" that is well linked internally might not need one, but it lists a new site with few external links as a case where a sitemap helps. Limits: a single sitemap is capped at 50MB uncompressed or 50,000 URLs. Google ignores the priority and changefreq fields and uses lastmod only if it is "consistently and verifiably" accurate, so leave lastmod out rather than stamping every URL with today's date.

Verify Search Console. Search Console offers several ownership methods, including an HTML file upload, an HTML tag on the homepage, Google Analytics, Google Tag Manager and a DNS record. The DNS method "is the only way to verify a Domain property," and Domain properties "include data for all protocol (http/https) and subdomain variations." Verification lasts only while the token stays in place, so do not delete the verification file or tag in a later redesign.

HTTPS. web.dev's advice is to "always protect all your websites with HTTPS, even if they don't handle sensitive communications," because it protects your site's integrity and "HTTPS is required for many new browser features." Check the redirect as well as the certificate: the http:// address should send visitors to https://, and web.dev recommends you eventually "redirect HTTP requests to HTTPS and use HTTP Strict Transport Security (HSTS)." It also suggests checking the setup with Qualys' SSL Server Test, where "your site should score an A or A+."

Speed: the Core Web Vitals thresholds. web.dev defines three metrics and what counts as good:

• Largest Contentful Paint (LCP), loading: within 2.5 seconds of when the page first starts loading.
• Interaction to Next Paint (INP), interactivity: 200 milliseconds or less.
• Cumulative Layout Shift (CLS), visual stability: 0.1 or less.

Google's guidance is to measure at "the 75th percentile of page loads, segmented across mobile and desktop devices." A brand new site usually has no field data yet. PageSpeed Insights builds its real-user section from the Chrome User Experience Report over the previous 28 days, and Google notes a page "might not have sufficient data if it has been recently published." Before launch you are working with lab numbers from the Lighthouse part of the report; treat them as a guide and recheck once real traffic arrives.

Accessibility: the W3C's quick first pass. The W3C's Web Accessibility Initiative publishes Easy Checks, a first review anyone can do on a live page. It covers image alt text, page titles, headings, color contrast, skip links, visible keyboard focus, the language of the page, zoom, captions, transcripts and audio description for media, form labels and required fields. Two concrete rules from the W3C pages:

• WCAG's contrast minimum (Level AA) asks for a contrast ratio of at least 4.5:1 for normal text and 3:1 for large text.
• Decorative images get an empty alt attribute (alt=""); images that carry information get a short description of that information.

The W3C is clear that these checks are "designed to be quick and easy, rather than exhaustive," and that a page can pass them and still have serious barriers. They are a launch-day floor, not an audit.

Analytics. Google Analytics 4 setup comes down to creating a property and a web data stream, then adding the Google tag. Many site builders only need the measurement ID, which starts with "G-" and sits under Admin, Data collection and modification, Data streams. To confirm it works before launch, open your site and look for yourself in the Realtime report, which shows "Active users in last 5 minutes" and in the last 30 minutes, or in DebugView, which shows events "in real time" while you install tags. Do not judge the setup from the standard reports on day one: Google says "data processing can take 24-48 hours."

Privacy policy and other legal pages. This is a pointer, not legal advice. What you need depends on where you and your visitors are and what you collect, so check the rules that apply to you or ask a lawyer. One requirement is written into a tool most sites use: the Google Analytics terms say "You must post a Privacy Policy" that gives notice of cookies or similar technology, and "You must disclose the use of Google Analytics, and how it collects and processes data."

Titles and descriptions. Google asks you to "make sure every page on your site has a title specified in the