The 28-point checklist I run before calling a site launched

Every time I ship a site I tell myself I'll "do the SEO and security stuff later." Later never comes, and three weeks in I find out the staging noindex is still there, or the link preview on Twitter is a blank grey box.

So I wrote the checklist down. This is the 28-point pass I now run on every site before I call it launched, grouped by how badly it bites you if you skip it.

Security headers (5)

Missing headers are the cheapest win on this whole list — most are one line in your reverse proxy.

1. HTTPS everywhere, and http:// actually 301s to https://. Test the bare apex and www.
2. HSTS — Strict-Transport-Security: max-age=31536000; includeSubDomains. Without it your first request is still hijackable.
3. Content-Security-Policy. Even a loose starter policy beats nothing. Start with default-src 'self' and loosen until things work.
4. X-Frame-Options: DENY (or CSP frame-ancestors 'none') — stops clickjacking.
5. X-Content-Type-Options: nosniff. One line, kills a whole class of MIME-confusion attacks.

Bonus: strip headers that leak your stack version (Server: nginx/1.18.0, X-Powered-By: Express). Free recon for anyone scanning you.

Crawlability (5)

This is the category that silently costs you the most, because nothing looks broken.

1. No stray noindex. The number one launch bug. Check the meta tag and the X-Robots-Tag header — staging configs love to set the header version where you won't see it in "view source."
2. robots.txt exists and doesn't Disallow: /.
3. sitemap.xml exists and is referenced from robots.txt.
4. Canonical URL on every page, absolute not relative.
5. Pick one hostname. www and non-www should not both serve 200 — redirect one to the other or you're splitting your own ranking.

Metadata and previews (6)

1. <title>, unique per page, roughly 50–60 characters.
2. <meta name="description">, 140–160 characters. Google rewrites it sometimes, but not having one guarantees a bad snippet.
3. Exactly one <h1> per page that actually describes the page.
4. Open Graph tags — og:title, og:description, og:image, og:type. This is what Slack, LinkedIn, iMessage and Facebook render.
5. Twitter card — twitter:card at minimum, otherwise your link is a naked URL.
6. A favicon. Yes, really. A default globe icon in the tab reads as "unfinished."

Test 14 and 15 by actually pasting the link into a Slack DM to yourself. It takes five seconds and I catch a broken og:image path about half the time.

Mobile and performance (7)

1. <meta name="viewport" content="width=device-width, initial-scale=1">. Without it phones render at 980px and zoom out. Instant bounce.
2. No horizontal scroll at 390px. Open devtools, set an iPhone width, and swipe. One min-width on a table does it.
3. Tap targets ≥ 44px. Fat fingers, small buttons, no conversions.
4. TTFB under ~600ms. If it's worse, it's usually a cold container or an N+1 query on the homepage.
5. Compression on — gzip or brotli. Check Content-Encoding in the response headers.
6. Cache-Control on static assets. Long max-age plus a content hash in the filename.
7. Width and height on <img>. Prevents layout shift, which is both a ranking factor and genuinely annoying.

Content integrity (5)

1. No broken internal links. Crawl your own site once. There's always one.
2. 404s return an actual 404 status, not a 200 with "not found" text. Soft-404s get your error pages indexed.
3. Alt text on meaningful images. Accessibility first, SEO second.
4. JSON-LD structured data for your page type (Organization, Product, Article). This is what earns rich results.
5. Load the site logged out, in a private window. You will be amazed what was only working because of your session cookie.

Running it

Doing all 28 by hand takes me about 40 minutes with devtools, curl and a Slack DM. That was annoying enough often enough that I automated it: LaunchAudit runs every check on this list against a live URL and gives you a 0–100 score plus a shareable report. It's free, there's no signup, and it takes about ten seconds.

It makes real HTTP requests against the actual page — no crawl queue, no "we'll email you the results."

Either way, run the list. The noindex one alone has cost me more traffic than every other item combined.

What's on your pre-launch checklist that I've missed here? I'd genuinely like to add to this.