Website launch and relaunch checklist
I use this list to check every website before it goes live. You see at a glance what would still stop your launch, and you go live without losing inquiries, emails or rankings.
0of 233 done
61 critical items openAll critical items done
Filter, check off, take it with you
- 01
Filter
Choose your stack: Webflow, custom code or both. With “Critical only”, you see first what would stop a launch.
- 02
Check off
Check off what's done, or mark an item as “Not applicable”. Under each item, you'll find why it matters and how to check it.
- 03
Take it with you
Copy the list with your progress as Markdown into a ticket, Notion or your project docs.
From positioning to ongoing operations
Critical items are marked. If one of them is open, the site doesn't go live.
No item matches your filter.
Research and positioning
These items belong before the first layout. Whatever is missing here can only be fixed later with a rebuild.
Why it matters
Without a clear picture of your buyers, you end up with copy that fits everyone and convinces no one.
How to check
Write three sentences: who buys, what is holding that person back right now, and what tips the decision in the end?
Why it matters
The goal decides which button sits at the top and what you measure later.
How to check
Name exactly one action as the main goal, such as a booked call, and note how you will recognize it in your tracking.
Why it matters
Once you know what the three strongest alternatives show, you quickly see where your own site sounds interchangeable.
How to check
Read three competitor sites the way a customer would and note the offer, the pricing, the proof and the first button on each.
Why it matters
Pages written around words your customers never search for won't be found, however good they look.
How to check
Collect terms from customer conversations, check them in Google and a keyword tool, and note what searchers expect for each one.
Why it matters
Two pages on the same topic compete with each other in search, and neither ranks properly.
How to check
Make a table: URL, main topic, search intent. If a topic appears twice, merge the pages.
Why it matters
The structure sets URLs, navigation and internal links. Changing it later costs redirects and often rankings too.
How to check
Map out the page hierarchy with every URL before the first layout is designed.
Why it matters
The questions that come up in every sales call are the ones your website has to answer.
How to check
Ask sales or support for the ten most common questions and objections, and note one piece of proof for each: a figure, a reference or a quote.
Why it matters
Without a baseline, there is no way to tell after launch whether the new site is better.
How to check
Write down, with the date: visits, inquiries, conversion rate and your most important rankings.
Why it matters
Otherwise, after the move you no longer have the list of old URLs and rankings to measure the relaunch against.
How to check
Export pages and queries for the last 16 months from Search Console, plus the pages with backlinks and your Core Web Vitals.
Why it matters
You can only tell whether ChatGPT or Perplexity mention you more often after launch if you have a figure from before.
How to check
Ask ChatGPT, Perplexity, Gemini and Google with AI Overviews your five to ten most important customer questions, and save the answers with the date.
Why it matters
People who only read a guide or come to log in as customers count in every statistic and make the site look more successful than it is.
How to check
Put your most visited pages and search terms into one of three groups: prospects with buying intent, readers without it, and existing customers. Then calculate the conversion rate for prospects only.
Why it matters
Personas often describe who you would like as customers, not who actually buys.
How to check
Put the numbers from your customer base next to each profile: count, revenue per customer and company size. If they don't match, that is your most important finding. Then decide who the website should really speak to.
Why it matters
Only once you know how much of a market you already reach can you see where there is room to grow and where there is little left.
How to check
Get the number of businesses or households per audience from official statistics or trade associations, note the source and date, and divide your customer count by it.
Why it matters
If a small product line gets most of the visits and most of the ad budget, the website is working against the business.
How to check
For each product line, put three shares side by side: of revenue, of visits and of ad budget. If they differ a lot, plan the site structure around revenue, not visits.
Why it matters
Trade media, associations and portals that link to your competitors already reach your audience today.
How to check
Use a backlink tool to list the referring sites of your two or three strongest competitors, and mark every one that doesn't link to you yet.
Why it matters
If hardly anyone searches for what you offer, you win customers through associations, trade media and trade fairs rather than more ads.
How to check
List the associations, trade journals, fairs and communities in your industry, each with its membership, circulation or visitor numbers and the date of that figure.
Why it matters
If your name, address or phone number differ from platform to platform, customers, search engines and AI assistants no longer know which one is right.
How to check
Set one binding version: company name, address in exactly one spelling, phone, website, year founded and a one-sentence description. Check every listing on the web against it.
Why it matters
Many customers see your map listing before your website, and sometimes it still points to an old domain.
How to check
Search for your company name in every major map service, not just the best known one. For each listing, check that you have claimed it and that the name, category, full address and website are right.
Why it matters
Abandoned accounts, duplicate profiles and other companies with similar names are more obvious to customers than to you.
How to check
Search for your company name on every platform and note followers, the date of the last post and whether it links to your website. Revive abandoned accounts or close them.
Why it matters
If you don't create a profile yourself, an unhappy customer may open it with the first review.
How to check
Check the general review platforms and the ones for your industry: rating, number of reviews, date of the latest one and how many you have replied to.
Why it matters
If the most common complaint contradicts a promise on your website, nobody believes that promise.
How to check
Read every one- and two-star review, sort them by topic and reply to the ones still open. The most common topic belongs in your positioning, not just in support.
Why it matters
Search engines and AI assistants learn from directories and industry lists who you are and what you offer.
How to check
Check general business directories, B2B directories, company databases and the lists of chambers, associations and trade fairs: do the details match your company data? Industry lists often only turn up in a search of their own.
Why it matters
AI assistants also read prices, availability and reviews straight from marketplace listings. Weak product data there reflects on your brand.
How to check
If you sell products, check your listings on the big marketplaces and with your main resellers: title, images, price, availability and reviews.
Why it matters
Some AI assistants rely on a different search index from the most popular search engine. If you're missing there, you show up less often in their answers too.
How to check
Search for your eight to ten most important terms in every major search engine, ideally in a private window, and note who ranks at the top instead of you.
Why it matters
The pages an AI assistant cites as sources shape whom it recommends. Often they are advice portals, videos and review sites, not your competitors.
How to check
For every AI answer to your customer questions, note the sources it cites and count which sites keep coming up. Those are the places you want to be mentioned.
Content and conversion
This decides whether visitors understand what you offer and whether they take the next step.
Why it matters
Visitors who don't know within a few seconds what you offer and for whom are gone again.
How to check
Show the page to someone on a smartphone for five seconds, then ask them what you sell.
Why it matters
When three equally strong buttons sit side by side, many visitors click none of them.
How to check
Mark the one button that counts on every page. All other links step back visually.
Why it matters
A button that leads nowhere costs you exactly the visitors who were ready to buy.
How to check
Click every button on desktop and smartphone and check that the destination delivers what the label promises.
Why it matters
When the price or the process is missing, many prospects don't ask. They look elsewhere.
How to check
Read every offer page with three questions in mind: what does it cost, what do I need to contribute, and what happens after the click?
Why it matters
A wrong number in a headline survives every style review and is only noticed by the customer.
How to check
Recalculate every figure from the original source, not from a chart, a screenshot or an earlier summary.
Why it matters
A client logo used without permission can lead to a legal warning and an annoyed client.
How to check
File the written approval, with its date, for every logo, quote and photo. Photos of people only with their explicit consent.
Why it matters
Clumsy sentences, or ones that sound translated, cost trust before your offer even lands.
How to check
Read every text out loud. If a sentence sounds translated or like a sales brochure, rewrite it.
Why it matters
Lorem ipsum, a tutorial video from the template or an empty blog post makes a live site look unfinished at once.
How to check
Search every page and CMS item for “Lorem”, “Test”, “TODO” and empty fields, in every language.
Why it matters
Two swapped digits in a phone number only show when the calls stop coming.
How to check
On a smartphone, tap every phone number and email address. Copy buttons copy the right text.
Why it matters
Almost every visitor sees page titles, error messages and confirmation emails, yet they are rarely edited.
How to check
Check page titles, meta descriptions, alt texts, form errors, confirmation emails, the cookie banner and the 404 page.
Why it matters
A site that switches between formal and informal address, or spells its own product names three ways, looks pieced together.
How to check
Search for the forms of address you use and for every spelling of your product and company names.
Why it matters
Native speakers spot a word-for-word translation in the first sentence.
How to check
Have each language read by a native speaker, and watch date, number and currency formats (€1,500 versus 1.500 €).
Why it matters
A copyright from two years ago or an old price makes the whole site look abandoned.
How to check
On the day you publish, check years, “as of” dates, prices, team and references.
Why it matters
Layouts only break with the longest headline, the longest name or the text in another language.
How to check
Fill in the longest real content you have, and leave optional fields empty as a test.
Legal and privacy
Legal mistakes don't show up in testing. They show up in a cease-and-desist letter. These items are no substitute for legal advice.
Why it matters
A privacy policy that lists different services from the ones the page loads doesn't describe what actually happens, and that makes it open to challenge.
How to check
Compare the operator, the address and every service named with what the browser really requests when the page loads.
Why it matters
In Germany, § 5 DDG has replaced the TMG since May 14, 2024, and many legal notices (Impressum) still cite the old law.
How to check
Check the reference to § 5 DDG. Editorial content such as a blog also needs a responsible person under § 18 (2) MStV.
Why it matters
If you sell to consumers online, you need more than a legal notice and a privacy policy.
How to check
Check with your legal advisor which mandatory information your offer requires and whether it is visible before the purchase is completed.
Why it matters
Since June 28, 2025, Germany's Accessibility Strengthening Act (BFSG, based on the European Accessibility Act) covers many services consumers sign up for online, such as shops and binding appointment bookings.
How to check
Check whether your offer falls under it. Micro-enterprises providing services (fewer than 10 employees, at most €2 million in turnover or balance sheet total) are exempt and should record the reason in writing.
Why it matters
Many services arrive through integrations, fonts or testing tools that nobody added on purpose.
How to check
Open the page in a private window, read every request, cookie and local storage entry in the developer tools, and note every external host.
Why it matters
Every service that processes personal data needs a contractual basis.
How to check
File the data processing agreement for every service and note where the data is stored and when it is deleted.
Why it matters
Under § 25 TDDDG (Germany's implementation of the ePrivacy rules), nothing that requires consent may load before the visitor agrees.
How to check
Load the page without clicking the banner and check in the network tab that no analytics or marketing service sends a request.
Why it matters
If rejecting is harder to find than accepting, the consent doesn't count as freely given.
How to check
Reject sits on the first layer, equal to Accept, no category is preselected, and a footer link reopens the settings.
Why it matters
A banner that only looks good doesn't protect you if services load even after a rejection.
How to check
Go through all three cases in a real browser and check cookies and network requests each time.
Why it matters
Every service that runs but isn't in the policy is a gap.
How to check
Every service you measured is listed, and nothing is listed that doesn't run.
Why it matters
When a font loads from Google Fonts, every visitor's IP address goes to Google without consent.
How to check
Look for requests to
fonts.googleapis.comandfonts.gstatic.comin the network tab. Unused fonts in the project settings can trigger them too.Why it matters
An embedded video, map or calendar sends data as soon as the page loads.
How to check
Show a preview image with a notice first, and load the service only after a click. A direct link stays visible as an alternative.
Why it matters
People entering data should know what happens to it before they send it.
How to check
Next to the submit button: purpose, recipient and retention period, with a link to the privacy policy.
Why it matters
Without a confirmed sign-up, you can't prove that someone really wanted your newsletter.
How to check
Sign up with a real address, confirm, unsubscribe again and check that no more emails arrive.
Why it matters
Under German price indication rules (PAngV), consumers must see total prices including VAT.
How to check
Check every price: gross for consumers, net for B2B with a clear “plus VAT” note.
Why it matters
Since August 2, 2026, the transparency rules in Article 50 of the EU AI Act apply, including to deepfakes.
How to check
Label realistic AI content, especially people and voices, as artificially generated.
Why it matters
A desktop license often doesn't cover a font on your website.
How to check
File the license for every font, piece of music and icon set, and check that it allows use on the web.
Why it matters
Superlatives like “the fastest provider” or guarantees without proof break German competition law (UWG).
How to check
Cut every superlative and every guarantee you can't back up with figures or sources.
Why it matters
Visitors to your English version have to understand what they are consenting to.
How to check
Check the banner, legal notice and privacy policy in every language version for completeness and matching content.
Why it matters
Under Article 50 of the EU AI Act, people talking to an AI must be able to tell.
How to check
The bot introduces itself as an AI at the start, and the privacy policy explains what happens to the conversations.
Why it matters
Tracking, forms and newsletters are processing activities that belong in the record required by Article 30 GDPR.
How to check
Enter every processing activity on the website with its purpose, data categories, recipients and retention period.
Why it matters
You have to answer access and erasure requests within one month (Article 12 (3) GDPR).
How to check
Send a test email to the address in your privacy policy and check who reads and handles it.
Security
Most website security problems aren't a hack. They're an exposed key, a forgotten login or an expired domain.
Why it matters
An API key in front-end code is readable by every visitor, and bots search for exactly that.
How to check
Search the shipped code, custom scripts in your CMS, source maps and the Git history for keys and passwords.
Why it matters
A deleted key still lives on in caches, archives and the Git history.
How to check
Create a new key with the provider and revoke the old one. Deleting it is not enough.
Why it matters
Anything that reaches the browser is public.
How to check
Keep credentials in a password manager and pass them to the server only through environment variables.
Why it matters
Without a valid certificate, browsers show a warning page instead of your website.
How to check
Open
http://andhttps://, with and without www. Every variant redirects to https.Why it matters
If a CAA record doesn't allow your host's certificate authority, the next certificate renewal fails without anyone noticing.
How to check
Look up the domain's CAA records. If there are any, they must allow the authorities your hosting and CDN use.
Why it matters
When an HTTPS page loads images or scripts over HTTP, the browser blocks them or shows a warning.
How to check
Check the browser console for “mixed content” messages.
Why it matters
Every admin account you don't need is one more way into your system.
How to check
Give each person only the rights they need, and get rid of shared accounts.
Why it matters
Whoever has the password for your registrar or DNS can redirect your website and your email.
How to check
Turn on 2FA for your registrar, DNS, hosting, CMS, CDN, form and email services, and remove access for people who have left the project.
Why it matters
A check that only runs in the browser can be bypassed with one click in the developer tools.
How to check
Send form and API requests without a browser, for example with
curl, and check that the server rejects invalid data.Why it matters
Headers like HSTS and Content-Security-Policy rule out whole classes of attacks.
How to check
Check the headers in the developer tools or with securityheaders.com: HSTS, CSP or at least frame-ancestors, X-Content-Type-Options and Referrer-Policy.
Why it matters
An outdated library brings its known vulnerabilities onto your site.
How to check
Run
npm auditor your package manager's equivalent, and update the affected packages.Why it matters
A script that always loads the latest version can change overnight without you noticing.
How to check
Replace “latest” in CDN URLs with a fixed version number, and note the purpose of every third-party script.
Why it matters
An error message showing a database path or an email address tells attackers more than they need to know.
How to check
Trigger errors on purpose, for example with invalid form data, and read what the page and the logs show.
Why it matters
Without these records, anyone can send email in your name, and your own messages land in spam more often.
How to check
Check the records with a DNS tool. Domains that send no email get
v=spf1 -alland DMARC withp=reject.Why it matters
If the domain expires, your website and your email are gone at once.
How to check
Turn on auto-renewal and the transfer lock, and note the expiry date.
Why it matters
Otherwise, when your domain expires, the warning goes to an address that stops working at exactly that moment.
How to check
Give your registrar and DNS provider an address on a different domain.
Why it matters
Without rate limiting, a bot can send thousands of requests to your form in a short time.
How to check
Limit requests per IP in the firewall or in code, and check that the crawlers you want are not blocked.
Why it matters
Anyone who finds a vulnerability then knows whom to report it to.
How to check
Put a contact address for security reports at
/.well-known/security.txt.
SEO and discoverability
A new website starts with no rankings. These items make sure Google finds and understands it, and that a relaunch doesn't cost you your old rankings.
Why it matters
The page title is the first thing searchers see of you in Google.
How to check
Every page has its own title of up to about 60 characters and a description of up to about 155 characters, in every language.
Why it matters
Search engines, AI systems and screen readers read a page's outline from its headings.
How to check
Use a browser extension or the accessibility view to check that H1 to H3 follow each other without skipping a level.
Why it matters
A noindex left over from testing keeps the whole website out of Google.
How to check
Check the robots meta tag in the source of every important page, and the
X-Robots-Tagheader in the network tab.Why it matters
An indexed test environment competes with your real website for the same search terms.
How to check
Search Google for
site:plus your staging address. Test environments get a password or noindex.Why it matters
If variants such as with and without www both work, links and signals are split across several addresses.
How to check
Open every variant: with and without www, with and without a trailing slash. Each one redirects to the main address in a single 301 step.
Why it matters
A wrong canonical tells Google that a different page is the real one.
How to check
Check on every page template that the canonical points to the page's own public address.
Why it matters
A sitemap full of redirects, test pages and noindex pages sends Google to the wrong places.
How to check
Open
/sitemap.xmland spot-check it: every URL answers with 200 and can be indexed.Why it matters
A single line left over from development can block whole folders for search engines.
How to check
Open
/robots.txt, check every Disallow line and point to the sitemap. To keep single pages out of the index, use noindex, not robots.txt.Why it matters
A page that no link points to is found by neither Google nor visitors.
How to check
Crawl the website with an SEO tool and look for pages without incoming internal links.
Why it matters
Google ignores broken markup, and details that aren't on the page break its guidelines.
How to check
Test important pages with the Rich Results Test and the Schema Markup Validator.
Why it matters
Without hreflang, Google may show the English page to people searching in German.
How to check
Every language version points to all the others and to itself, plus an x-default. The lang attribute matches the language.
Why it matters
It shows you which pages Google indexes and why it leaves others out.
How to check
Create a domain property, verify it through DNS and submit the sitemap.
Why it matters
The Bing index also feeds Microsoft Copilot and is used by AI search tools.
How to check
Import the property from Search Console, submit the sitemap and turn on IndexNow if your system supports it.
Why it matters
Every old URL without a redirect loses its rankings and backlinks.
How to check
Collect old URLs from a crawl, the sitemap, Search Console and backlink data, and test every redirect one by one.
Why it matters
If every old URL redirects to the home page, Google treats it as a soft 404, and the rankings are lost anyway.
How to check
Every old URL redirects in one step to the new page with matching content.
Why it matters
Otherwise empty categories, tag pages and template pages without content end up in the index and drag down the whole site.
How to check
Set such pages to noindex, remove them from the sitemap or delete them.
Why it matters
For local searches, Google shows the business profile above the regular results.
How to check
Name, address and phone number in your Google Business Profile match the website exactly.
Why it matters
Other extensions or old brand names that lead nowhere waste visitors and links.
How to check
Every additional domain redirects to the main domain with a 301 and has a valid certificate.
Visibility in AI answers
ChatGPT, Perplexity and Google AI Overviews answer questions before anyone opens a website. These items affect whether your site shows up as a source.
Why it matters
If you block AI crawlers by accident, you won't appear as a source in ChatGPT or Perplexity.
How to check
Check the robots.txt entries for OAI-SearchBot, GPTBot, ClaudeBot, Claude-SearchBot, PerplexityBot and Google-Extended, and decide on each one separately.
Why it matters
Depending on its settings, Cloudflare can block AI crawlers on its own, without it showing in your robots.txt.
How to check
Check AI Crawl Control and the bot settings, and compare the robots.txt that is served with your own.
Why it matters
Most AI crawlers don't run JavaScript and only see what is in the HTML that's served.
How to check
Fetch the page with
curlor open the source, and check that headings, copy and prices are in it.Why it matters
AI answers prefer sentences that make sense on their own.
How to check
Write in full sentences who you are, what you offer, for whom, where and at what price. The same details appear on LinkedIn and in directories.
Why it matters
Organization or Person markup with sameAs links your website to your profiles.
How to check
Add Organization or Person with sameAs, plus Service, Article and BreadcrumbList wherever they describe visible content.
Why it matters
For any question, AI systems look for the section that answers it most directly.
How to check
Phrase important H2s as your customers' questions and answer them in the first sentence below.
Why it matters
An article without a date and an author leaves open whether it is current and who stands behind it.
How to check
Show the author and the published and updated dates on articles, and add both to the Article markup.
Why it matters
The file sums up your website for language models. There is no evidence yet that it improves visibility.
How to check
Add it as an extra, never as a replacement for the items above.
Images and previews
Images affect load time and accessibility, and they decide how your link looks on LinkedIn or in WhatsApp.
Why it matters
In the browser tab and on the home screen, the icon is often all anyone sees of your brand.
How to check
Add an SVG favicon, a 32 px PNG and a 180 px Apple touch icon, and check them on a light and a dark tab.
Why it matters
Without a preview image, a shared link on LinkedIn looks like an empty box.
How to check
Every important page has a title, a description and a 1200 × 630 px image with an absolute URL, in every language.
Why it matters
LinkedIn and Facebook cache old previews and keep showing them until you have them re-scraped.
How to check
Check your links in the LinkedIn Post Inspector and Meta's Sharing Debugger, and test them in Slack and WhatsApp as well.
Why it matters
Screen readers read the alt text aloud, and search engines use it to understand what an image shows.
How to check
Describe informative images in one sentence. Decorative ones get an empty alt attribute. Every language gets its own texts.
Why it matters
One uncompressed photo can weigh more than the whole rest of the page.
How to check
Use AVIF or WebP and
srcsetwith fitting sizes, and check the image size hints in PageSpeed Insights.Why it matters
Without fixed dimensions, text jumps down while the page loads, and visitors click the wrong thing.
How to check
Every image has
widthandheightor a fixed aspect ratio in CSS. The CLS score in PageSpeed Insights shows whether anything still jumps.Why it matters
Images nobody can see yet slow down the part of the page that is visible.
How to check
Add
loading="lazy"to every image below the first screen.Why it matters
The large image at the top is usually the element Google uses to measure load time (LCP).
How to check
No
loading="lazy"on the main image, andfetchpriority="high"where needed.Why it matters
A stock photo without the right license can lead to an expensive legal warning.
How to check
File the source, the license and any required credit for every image.
Why it matters
Image generators like to invent illegible letters, and on a company website they stand out at once.
How to check
Check every generated image at full size. Text belongs on top of the image as HTML, not inside it.
Why it matters
A video that starts with sound uninvited drives visitors away and breaks WCAG.
How to check
Set a poster image, use autoplay only with
mutedandplaysinline, add captions for spoken content, and make pausing possible.Why it matters
Traced or blurry logos look unprofessional and can break the brand's guidelines.
How to check
Take the SVG from the brand's press area or from a maintained collection such as svgl.
Usability and accessibility
A site that only works with a mouse and a large screen shuts out many visitors. The benchmark is WCAG 2.2.
Why it matters
The device view in the browser doesn't show real touch behavior or a real on-screen keyboard.
How to check
Test on at least one iPhone, one Android device and one tablet.
Why it matters
Safari renders some things differently from Chrome, and on the iPhone every browser runs on Safari's engine.
How to check
Check Chrome, Safari, Firefox and Edge, plus Safari on iOS.
Why it matters
One element that is too wide makes the whole page wobble sideways on a smartphone.
How to check
Shrink the window to 320 px wide and scroll through every page once.
Why it matters
Long compound words, common in German, overflow any headline on a smartphone.
How to check
Set the lang attribute correctly and use
hyphens: autoor soft hyphens in large headings.Why it matters
Otherwise people who don't use a mouse can't get through the menu, dialogs and forms.
How to check
Put the mouse away and go through the page using only Tab, Shift+Tab, Enter, Space and Escape.
Why it matters
Without a visible focus, keyboard users don't know where they are.
How to check
Every focused element gets a clear outline, and the first Tab lands on “Skip to content”.
Why it matters
Light gray text on white is simply unreadable for many people.
How to check
Body text needs 4.5:1, large text and controls 3:1. Measure with the developer tools or a contrast checker.
Why it matters
Small links packed closely together lead to constant mis-taps on a smartphone.
How to check
At least 24 × 24 px (WCAG 2.2, criterion 2.5.8), better 44 px on touch devices.
Why it matters
Placeholder text disappears as you type and is no substitute for a label.
How to check
Every field has a visible label, and error messages say what is wrong and how to fix it.
Why it matters
Many people enlarge the text, and then copy overlaps or buttons disappear.
How to check
Zoom the browser to 200 % and check that everything stays readable and usable.
Why it matters
Only when it is read aloud do you notice that a button is just called “button” or a dialog loses focus.
How to check
Go through the main flows with VoiceOver on a Mac and an iPhone.
Why it matters
Landmarks let screen reader users jump straight to the navigation or the main content.
How to check
Use
header,nav,mainandfooter, and mark passages in another language with their own lang attribute.Why it matters
Animations can make people with vestibular disorders dizzy.
How to check
Turn on “Reduce motion” in the operating system and check that animations stop. Anything that runs on its own for more than five seconds can be paused.
Why it matters
WebGL and video backgrounds cost battery and processing power, even when nobody is looking at them.
How to check
Animated backgrounds pause when off screen or in an inactive tab, and show a still image without WebGL.
Why it matters
Short transitions on hover, loading and success show that the page responds. Long effects slow people down.
How to check
Keep transitions short and use the same few animations across the whole website.
Why it matters
A dark logo on a dark background disappears without anyone noticing.
How to check
Switch the system to dark and go through every page, including forms and banners.
Why it matters
A banner that can't be closed by keyboard locks keyboard users out of the whole site.
How to check
The banner works by keyboard, covers no controls and keeps the legal notice and privacy policy reachable.
Forms and workflows
On many websites, the contact form is the most important workflow. If it breaks, often nobody notices until the inquiries stop.
Why it matters
Accented characters, long names and pasted addresses throw badly built forms off balance.
How to check
Test empty required fields, invalid emails, accented characters, very long input and text pasted from the clipboard.
Why it matters
Input that is only checked in the browser can be bypassed and lands unfiltered in your system.
How to check
Send invalid data straight to the server and check that it rejects it.
Why it matters
Without spam protection, real inquiries drown among bot messages.
How to check
Use Cloudflare Turnstile or a honeypot field, and check that the server really evaluates the result.
Why it matters
Otherwise a double click sends two inquiries and creates duplicates in your CRM.
How to check
Disable the button after the first click, and check whether a double click creates two entries.
Why it matters
If a form reports success although sending failed, the inquiry is lost and the customer waits in vain.
How to check
Simulate an outage in the network tab and check that a clear error message with an alternative appears.
Why it matters
Only the inbox or the CRM shows whether an inquiry arrives complete.
How to check
Send a real inquiry and check every field where it ends up, whether that is an inbox, a CRM or a database.
Why it matters
If the notification lands in spam, or your reply goes to yourself instead of the customer, you lose the inquiry.
How to check
Check the inbox and the spam folder, and click “Reply”: the reply must go to the person who asked.
Why it matters
Any step that was only tested on paper can fail live.
How to check
Run every flow with test data through to the confirmation, and payments in the provider's test mode.
Why it matters
If a third-party calendar or form doesn't load, visitors face an empty space.
How to check
Block the service in the browser as a test. An email address or phone number stays visible as an alternative.
Why it matters
Email addresses in URL parameters end up in logs, in analytics and in the next shared link.
How to check
Submit a test form and check the address bar, the redirect and the analytics events that were sent.
Why it matters
With the right field type, the smartphone opens the matching keyboard and the browser fills in details by itself.
How to check
Use
type="email"andtype="tel"and autocomplete values such asname,emailandtel.Why it matters
If the confirmation email repeats free-text input, spammers use your form to send their messages.
How to check
Check the template: it contains no field contents and no links taken from input.
Why it matters
Otherwise your analytics won't count bookings in embedded calendars or forms as conversions.
How to check
Book a test appointment and check that the event arrives and the way back to your site works.
Why it matters
Inquiries that sit in a form service for years are a privacy risk with no benefit.
How to check
Decide when entries are deleted, and set up a reminder or automatic deletion.
Performance and tech
Google factors in load time, and on a smartphone it decides whether someone stays.
Why it matters
A score from your own fast computer says nothing about a mid-range smartphone on a mobile network.
How to check
Test the home page, a service page and an article in PageSpeed Insights, mobile first.
Why it matters
A page counts as good with LCP up to 2.5 s, INP up to 200 ms and CLS up to 0.1.
How to check
Measure LCP and CLS in the lab. INP only comes from real user data. In the lab, Total Blocking Time is the stand-in.
Why it matters
What runs smoothly on office Wi-Fi stutters on an older smartphone.
How to check
Throttle the developer tools to “Slow 4G” and a 4× slower CPU, then reload the page.
Why it matters
Lab scores are an estimate. Only field data shows what visitors actually experience.
How to check
After four weeks, check the Core Web Vitals report in Search Console.
Why it matters
Every third-party script adds load time, even if nobody looks at its data anymore.
How to check
List every script in the network tab, remove the unused ones and move tracking to the server wherever you can.
Why it matters
A font family in eight weights can load more than all your images together.
How to check
Use WOFF2 with only the weights and characters you need, preload the main font and set
font-display.Why it matters
Without caching, every visitor downloads everything again on every page change.
How to check
Check the response headers for Brotli or gzip and long cache times for versioned files. After a publish, the new version is visible right away.
Why it matters
A JavaScript error can break the menu, a form or tracking without anything looking wrong.
How to check
Open the console on every page template and fix red messages and 404 requests.
Why it matters
Dead links annoy visitors and waste internal link value.
How to check
Crawl the website with a link checker, and open the most important destinations by hand as well.
Why it matters
If the error page returns status 200, Google treats it as a normal page.
How to check
Open a made-up URL and check the status code in the network tab.
Why it matters
A page that returns a 301 or 500 by mistake is gone for visitors and for Google.
How to check
Request your most important URLs with
curl -Ior a crawler. Each one answers with 200.Why it matters
Ad blockers block many third-party scripts. If your form depends on one of them, no inquiry gets through.
How to check
Test the page with an ad blocker on: content, navigation and the form keep working.
Analytics, consent and Cloudflare Zaraz
Tracking that counts twice, bypasses consent or fails silently does more harm than none at all. The Zaraz items only apply if you use Cloudflare Zaraz.
Why it matters
If you only think about what to measure after launch, you have no data from the first weeks.
How to check
Write down which events count: inquiries, bookings, purchases and the most important clicks, each with its name and parameters.
Why it matters
An event that fires every time the thank-you page is reloaded doubles your conversions.
How to check
Trigger each event once and check the count and values in the realtime or debug view.
Why it matters
If analytics runs through a CMS integration and the tag manager at the same time, everything counts twice, and one of the two usually bypasses consent.
How to check
Check CMS integrations, the tag manager and your own scripts, and keep exactly one path for each service.
Why it matters
On small websites, test visits and bots quickly make up a large share of the numbers.
How to check
Set up filters for internal traffic and check unusual countries, sources and zero-second sessions.
Why it matters
Only a real browser shows whether services really stay silent after a rejection.
How to check
Test in a private window with empty cookies. Depending on its settings, Zaraz doesn't load for automated requests at all, so a check with
curltells you nothing.Why it matters
Without Consent Mode v2, Google limits measurement and remarketing for visitors from the EEA.
How to check
Use Tag Assistant to check that the consent values are passed correctly after accepting and after rejecting.
Why it matters
Tools like Microsoft Clarity record clicks, scrolling and input. Since October 31, 2025, Clarity requires a consent signal for visitors from the EEA, the UK and Switzerland.
How to check
Load the tool only after consent, pass the consent signal and check that form fields are masked.
Why it matters
If the browser and the server send the same event, the platform counts it twice.
How to check
Check the Conversions API or Measurement Protocol with test events, and deduplicate with a shared event ID.
Why it matters
Sometimes “linkedin”, sometimes “LinkedIn”: inconsistent parameters split one campaign into several rows.
How to check
Fix the spellings for source, medium and campaign, and build campaign links only that way from now on.
Why it matters
By default, GA4 deletes detailed data after just two months.
How to check
Set data retention to 14 months, make a deliberate decision on Google Signals and set up a filter for internal traffic.
Why it matters
A test without a hypothesis and a minimum run time produces chance that looks like a result.
How to check
Fix the hypothesis and the run time in advance, check that the variant loads without flicker, and don't test on legal pages.
Why it matters
Ad blockers filter the default paths under
/cdn-cgi/zaraz/by pattern. Custom paths on your own domain don't stand out.How to check
Set Initialization, Main and Track in the Zaraz settings to custom paths, such as
/_zi,/_zmand/_zt. No address on your website may start with any of them.Why it matters
A loader that still points to the old path runs into a 404, and the banner and tracking are missing without anything visibly breaking.
How to check
Search the source for
/cdn-cgi/zaraz/i.jsand replace every match with the new path.Why it matters
Whether Cloudflare inserts the Zaraz script by itself depends on the setup.
How to check
Fetch the HTML that is served and count the Zaraz script tags. There must be exactly one.
Why it matters
With Cloudflare Workers and static assets, the edge doesn't insert the Zaraz script automatically.
How to check
Set
autoInjectScriptto false and write the loader into the HTML before</head>.Why it matters
Cloudflare doesn't document the consent modal's selectors, so hand-written CSS is guesswork.
How to check
Generate the CSS with the Zaraz Consent Banner Designer and paste it under Zaraz, Consent, Custom CSS.
Why it matters
Zaraz only checks how an address begins. With the track path
/t, real visitors get an error instead of content on every page starting with /t.How to check
Compare every address in your sitemap with your three Zaraz paths: none may start that way. Then check a page in a normal browser.
curland headless browsers don't see the error, because Zaraz lets automated requests through.Why it matters
Ad links carry UTM parameters, and Meta adds its own ID to every click. If the landing page only works without these extras, you pay for every click that lands on an error page.
How to check
Open every landing page once with the finished ad link and once with
?fbclid=testappended. Compare status, page title and content with a request without extras, and check that the parameters survive redirects. A 200 status alone isn't enough: it has to be your landing page that answers.
Webflow
These items only apply to Webflow websites. Many of them are settings nobody touches during the build.
Why it matters
Otherwise the webflow.io address is a complete copy of your website in Google.
How to check
In Site Settings under SEO, turn off indexing for the Webflow subdomain and set the global canonical URL.
Why it matters
An analytics ID under Integrations or a Google font under Fonts loads past any cookie banner.
How to check
Go through Integrations and Fonts, and remove everything that should run through your consent manager or isn't used.
Why it matters
If data collection is set to “always”, both tools collect data before anyone agrees.
How to check
Switch data collection for Analyze and Optimize to consent-based and connect it to your banner.
Why it matters
A hard-coded /de link sends visitors of the English version back to German.
How to check
Link internal pages as page links rather than URLs, and click through the navigation in every language.
Why it matters
Untranslated slugs, SEO fields or alt texts give away at once that the second language was an afterthought.
How to check
For each language, check the slug, page title, description, Open Graph image and alt texts, in CMS items too.
Why it matters
Empty template pages, wrong image fields or drafts in lists only show up once you're live.
How to check
Check that drafts aren't linked anywhere, thin template pages have noindex, the Open Graph image uses the right field and the intended date appears.
Why it matters
In Webflow, recipients, the reply-to address and messages are separate settings that are easy to forget during the build.
How to check
In Site Settings, check the notification recipients, reply-to address and spam protection, and translate the success and error messages.
Why it matters
Webflow only redirects old URLs that are entered in the settings.
How to check
Add every old URL to the 301 redirects in Site Settings under Publishing, and test them after publishing.
Why it matters
Everything in custom code is publicly visible in the source of every page.
How to check
Search the site, page and embed custom code for keys and passwords, and keep a versioned copy of the code outside Webflow.
Why it matters
One click on “Publish” with the wrong domains selected puts half-finished pages live.
How to check
Publish work in progress only to the webflow.io address, and to your own domain only after sign-off.
Why it matters
In an emergency, a named backup is quicker to find than one of many automatic versions.
How to check
Create a named version under Backups before you publish to your own domain.
Why it matters
Unused classes, interactions and assets bloat your CSS and page weight.
How to check
Use “Clean up” in the Style Manager, delete unused interactions and assets, and turn on the minify options if offered.
Why it matters
The wrong SSL mode or overly aggressive caching leads to redirect loops or stale content after publishing.
How to check
Set SSL to Full (strict) and set up cache rules so that a publish is visible right away.
Why it matters
Form submissions, CMS items, bandwidth and languages depend on the site plan.
How to check
Compare your plan's limits with what the website needs at launch and in its first year.
Why it matters
Otherwise the 404 page, password page and search results stay in Webflow's default look.
How to check
Open every utility page in every language and adapt its design and copy.
Why it matters
When translating, Webflow can replace an icon embedded as SVG with an empty element, and nobody gets a warning.
How to check
After every translation pass, compare the icons and graphics of each page in both languages, and keep text and icon in separate elements.
Code and Cloudflare Workers
These items apply to custom-built websites, for example with Astro or Next.js on Cloudflare Workers.
Why it matters
A .env file in the repository can be read by everyone with access, and by anyone at all if the repository is public.
How to check
Check
.gitignoreand the build folder for.envand.dev.vars, and store secrets withwrangler secretor in the Secrets Store.Why it matters
In single-page-application mode, every unknown URL returns status 200 and becomes a soft 404.
How to check
For websites, set
not_found_handlingto404-pageand check a made-up URL for status 404.Why it matters
Mistakes in
_headersor_redirectsonly show up live.How to check
Request the affected URLs with
curl -Iand check headers, status codes and redirect targets.Why it matters
Otherwise the workers.dev address is a second, publicly reachable copy of your website.
How to check
Turn off the workers.dev route or protect previews with Cloudflare Access.
Why it matters
Hydration errors and missing environment variables often only show up in the production build.
How to check
Build and run the production version locally and read every warning.
Why it matters
Public source maps reveal your complete source code, comments included.
How to check
Check whether
.mapfiles can be fetched publicly, and decide deliberately whether that should stay.Why it matters
Bindings, routes and a custom domain that are only set for development are missing live.
How to check
Check the production environment in
wrangler.jsonc: KV, D1, R2, routes and domain.Why it matters
Without logs, you look for errors after launch in the dark.
How to check
Turn on Workers Logs and spot-check them for email addresses, IPs and form contents.
Go-live and operations
The launch itself takes minutes. Most outages happen in the hours before and after: with DNS, with email and with the first real test.
Why it matters
One wrong DNS record can make the website unreachable for hours.
How to check
Check the A, AAAA and CNAME records against your host's instructions, and open every domain variant.
Why it matters
Forget the MX records during the move and you stop receiving email from launch day.
How to check
Export every record, especially MX, SPF, DKIM, DMARC and verification TXT records, and carry them all over.
Why it matters
With a high TTL, some visitors still land on the old server for a day.
How to check
Lower the TTL to a few minutes one day before, and raise it again after launch.
Why it matters
An open preview shows unfinished work and ends up in the index.
How to check
Protect previews with a password or access control.
Why it matters
A test API, a sandbox payment account or a debug switch in production only shows up with the first customer.
How to check
Check environment variables, API keys and connections to other services for production values.
Why it matters
A reachable /.git folder gives away your complete source code and its history.
How to check
Request
/.git/config,/.envand common backup files on your domain. Every request must return 404.Why it matters
A backup that has never been restored is only a hope.
How to check
Make a backup and restore it once as a test, for example to a staging environment.
Why it matters
If something breaks after launch, the time it takes to get back to the old version decides how much damage is done.
How to check
Write down the rollback as a command or a click path before you publish.
Why it matters
Otherwise, if the site goes down at night, the first customer in the morning is the one who notices.
How to check
Set up an uptime check with alerts, monitor domain and certificate expiry, and decide who responds.
Why it matters
A launch on a Friday afternoon means bugs stay up all weekend.
How to check
Don't publish right before a weekend, a holiday or a vacation, and keep time free for fixes in the days after.
Why it matters
Live behaves differently from staging: another domain, another cache, real DNS.
How to check
On the real domain, check the home page, key subpages, forms, the banner and tracking.
Why it matters
If you pass on a link without checking it, the client may be the one who finds the first bug.
How to check
At handover, share exactly the public URL you have just tested.
Why it matters
Cancel the old hosting too early and you lose redirects, email or data that still depended on it.
How to check
Only cancel once redirects, email and forms are proven to work on the new setup.
Why it matters
Otherwise broken tracking or a silent form is only noticed weeks later.
How to check
Set up a notification for when form submissions, conversions or tracking events suddenly drop to zero.
Handover and first weeks
After launch, you find out whether Google indexes the site, forms arrive and the numbers add up. Schedule fixed dates for these checks.
Why it matters
If the domain is registered to the agency, the client doesn't own their own address.
How to check
Domain, hosting, CMS, analytics and Search Console belong to the client. Service providers get their own logins instead of shared passwords.
Why it matters
A team that can't use the CMS calls for every text change or lets the site go stale.
How to check
Show them how to edit content and where to find form submissions, and leave a short guide.
Why it matters
Otherwise, a year from now nobody knows where the DNS is managed.
How to check
Write down where the code, logins, DNS and tracking configuration live, and keep the logins in a shared password manager.
Why it matters
Problems with indexing, delivery and conversions only show up after a while.
How to check
At each date, check indexing, forms, email delivery, errors and conversions.
Why it matters
Chrome's user data builds up over 28 days, so there is no reliable picture before that.
How to check
After four weeks, check PageSpeed Insights and Search Console, provided the site has enough visitors.
Why it matters
After a relaunch, missing redirects show up as a rising number of 404 errors.
How to check
Check indexing, 404 errors and the redirects of old URLs, and compare clicks with your baseline.
Why it matters
Only the comparison with your baseline shows whether your changes work.
How to check
After four and after twelve weeks, ask the same questions as before launch and compare the answers.
Why it matters
Old links in profiles and signatures send visitors on detours or into nothing.
How to check
Update social profiles, email signatures, business profiles and directories, and ask key partners to update their links.
Why it matters
Promote the launch before everything works and you send most visitors straight into the bugs.
How to check
Announce it on LinkedIn, in your newsletter and to existing customers only once the test on the real domain has passed.
Ongoing operations
A website doesn't stay the way it was at launch. New services, expiring contracts and outdated content creep in quietly.
Why it matters
External sites move, and links that worked yesterday lead nowhere.
How to check
Crawl the website once a quarter and fix dead links.
Why it matters
New tools often get added without anyone agreeing on them, and then run past the banner.
How to check
Measure the requests again in a private window and compare them with the banner and the privacy policy.
Why it matters
Known vulnerabilities in old versions are exploited on purpose.
How to check
Update packages and third-party scripts, then check the most important flows.
Why it matters
Former employees and contractors often keep access for a long time.
How to check
Remove logins nobody needs anymore, and check that 2FA is on everywhere.
Why it matters
Whether a backup is any good only shows when you restore it.
How to check
Restore a backup as a test once a quarter.
Why it matters
Otherwise the domain, certificate, hosting and licenses expire on an inconvenient day.
How to check
Check expiry dates and automatic renewals.
Why it matters
A slow decline only shows when you compare with the last quarter.
How to check
Compare Core Web Vitals, Search Console and AI visibility with the last round.
Why it matters
Old prices, former team members and references from years ago cost trust.
How to check
Check prices, team, references and years.
Questions about the launch checklist
Christian Schmitt answersWhen the project starts. Section 1 belongs before the first layout, and some figures only exist before launch, such as the baseline data from Search Console.
Christian Schmitt answersA critical item affects security, privacy, availability or a core workflow such as the contact form. As long as one of them is open, the site doesn't go live.
Christian Schmitt answersNo. Filter by your stack and mark items that don't apply to your project as “Not applicable”. Both count toward your progress.
Christian Schmitt answersNo. 207 items apply to every website. On top of that, 16 items apply only to Webflow and 10 only to custom-built websites, for example with Astro on Cloudflare Workers.
Christian Schmitt answersOnly in your browser's local storage. Nothing is sent to a server, and in another browser or on another device you start from scratch. “Copy as Markdown” lets you take your progress with you.
Christian Schmitt answersNo. The legal and privacy items show you where to look more closely. Whether your legal notice, privacy policy and cookie banner hold up is a question for a lawyer or a legal text service that accepts liability for its texts.
Christian Schmitt answersThe list is current as of Oct 15, 2026. I last checked the details on Germany's BFSG, DDG and TDDDG and on the EU AI Act on Oct 9, 2026.
