Launch checklist.
This is the list I run every Sunday before a site goes live. It has not shortened since I started using it. Nothing on here is optional — if an item cannot be ticked, the week does not end. If it still cannot be ticked by 23:59 GMT, the refund clause triggers and the launch re-scopes.
Performance
- Lighthouse ≥ 95 on mobileThrottled 4G profile, not studio wifi.
- LCP under 2.0sHero image preloaded, font-display: swap.
- CLS effectively zeroReserve space for every async element, including ads.
- INP under 200msDefer non-critical JS. No layout-shifting hydration.
- Images in AVIF or WebPResponsive srcset. Lazy-load below the fold.
- Fonts subset and self-hostedPreload the display face. Drop unused weights.
- JS bundle under 140KB gzippedFirst-party only. Audit every dependency.
Accessibility (WCAG 2.2 AA)
- Keyboard-navigable on every pageTab order matches visual order. No traps.
- Focus states visibleNot just colour — a 2px ring minimum.
- Colour contrast measured4.5:1 for body, 3:1 for large text — tested, not assumed.
- Skip-to-content linkFirst tab-stop. Announced by screen readers.
- Headings form an outlineOne H1, logical H2s, no skipped levels.
- Images have meaningful alt textEmpty alt for decorative, described alt for informational.
- Forms have associated labelsaria-describedby on errors. Announce on submit.
- prefers-reduced-motion honouredAll animations tested with the flag on.
SEO
- Unique title + meta descriptionEvery indexable page. No duplicates.
- Open Graph + Twitter cards1200×630, unique per key page.
- Canonical URLs setEspecially if trailing-slash or www variants exist.
- robots.txt + sitemap.xmlSitemap references canonical URLs only.
- Schema.org JSON-LDOrganization + Service or Product + FAQ where real.
- Favicon + apple-touch-iconSVG + 180×180 PNG minimum.
- Broken link scanInternal and external. Fix or remove — no 404s on launch.
Analytics + tracking
- Analytics installed once, correctlyPlausible or Fathom preferred. Cookie-free where possible.
- Goal conversion events definedContact form submit, CTA click, checkout complete.
- Cookie notice only if neededDon’t stack consent UI if you have no cookies to consent to.
- Search Console verifiedSubmit sitemap. Fix coverage warnings before launch.
Content + proofing
- Copy proofed end-to-endRead aloud. Every page. No placeholders.
- Dates, phone numbers, addresses verifiedOne typo here costs trust for months.
- Email addresses liveActually send a test to every public mailto.
- Legal pages publishedPrivacy + Terms at minimum. Dated.
- Error + 404 page is on-brandSame nav, same tone, useful links out.
Infrastructure
- HTTPS enforced, HSTS onPreload if the domain will never serve plaintext.
- DNS TTL lowered before the flip300s the day before. Restore after.
- Redirects in placeOld paths → new paths. Test every one.
- Environment variables setProduction keys only. No .env secrets in the repo.
- Build reproducible from gitFresh clone + install + build → identical output.
Handover
- Repository transferred to client GitHubBranch protection on main.
- Vercel project on client billingOwner = client, not studio.
- Domain remains on client registrarNo nameservers on studio account.
- README written for a strangerInstall, run, deploy, rollback. Nothing assumed.
- Loom recordedTwenty minutes. Edit a page, deploy, roll back.
- Credentials handed over, studio copies deletedWithin 7 days of launch. Document it.
Using this
Print it. Tick it with a pen. A digital checklist lets you lie to yourself. A paper one does not. Forty-two items fit on two sides of A4 — the second side is where the last four fail.