The 13 checks we run before launching any website

Alessandro Giacani — Tue, 27 Oct 2026 09:54:19 +0000

Most launch problems are boring ones: something nobody checked. An expired certificate on a subdomain. A redirect chain three hops long. A missing DMARC record that sends order confirmations to spam.

At BitHub, a small technical web agency in Italy, we build custom eCommerce platforms and migrate stores off PrestaShop and WooCommerce. Over time our pre-launch checklist settled on 13 checks. Here they are, with why each one matters.

Performance and real users

1. Lighthouse audit. Performance, accessibility, SEO and best practices in one run. It is a lab test, so treat it as a baseline, not as the truth about your users.

2. CrUX (Chrome UX Report). Real-user Core Web Vitals (LCP, INP, CLS) collected by Chrome. If Lighthouse says 98 and CrUX says your LCP is poor, believe CrUX.

3. Green audit. A quick look at page weight and hosting footprint. Lighter pages are faster pages, so this rarely conflicts with performance work.

Transport and protocol

4. TLS certificate. Issuer, expiry date, chain. Check every hostname you serve, not just the apex domain.

5. HTTP/2 and HTTP/3 support. Many hosts still serve HTTP/1.1 by default. Multiplexing makes a measurable difference on asset-heavy pages.

6. HTTP ping. Response latency from the outside. A slow TTFB usually points to the server or the application, not the frontend.

Security

7. Security headers. HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Most sites ship with half of them missing.

Crawling and SEO plumbing

8. Redirect chains. After a migration, old URLs often hop through http → https → www → new path. Each hop costs time and crawl budget. Aim for one 301.

9. robots.txt and sitemaps. Is the sitemap declared? Does it list only indexable URLs? Did the staging Disallow: / survive into production? (It happens more than you think.)

Domain and email

10. DNS records. A, AAAA, CNAME, MX, TXT: confirm they point where you think after a hosting change.

11. WHOIS. Registrar and expiry date. Domains expire on the same day the person who registered them leaves the company.

12. SPF and DMARC. If your store sends order emails, these decide whether they reach the inbox.

13. SMTP test. A real handshake with the mail server, to confirm it accepts connections and offers TLS.

One tool instead of thirteen tabs

Running these checks usually means juggling a dozen different websites. So we built Web Diagnostics Toolkit, which puts all 13 in one place. It is free, needs no account, and runs on the web, iOS and Android. The web version runs everything a browser can do; the native apps add the full SMTP handshake and ALPN detection, which browsers cannot perform.

What would you add to the list? I am curious which check has saved your launch.

Alessandro Giacani, CEO at BitHub