What should I check before launching a website?

Request all four combinations: `http` and `https`, apex and `www`. Each should either serve or redirect to the one that does, and none should time out.

Confirm the DNS records are published and that the TTL is low enough to correct a mistake quickly. Lowering it after launch does nothing for copies already cached.

Check any subdomain you rely on — an API host, a mail host, a documentation site — since each is a separate name with its own records.

`curl -sI` against each combination takes a minute and catches the most common launch-day failure, which is a hostname nobody tested.

Confirm the domain itself is not about to expire. A registration lapsing days after launch takes the site, the mail and every subdomain with it.

A `noindex` left from staging removes the site from search results silently, over days, and nothing on the page looks wrong.

Check both places it can live: a robots meta tag in the HTML, and an `X-Robots-Tag` HTTP header. A clean head does not rule out a header set by the server.

Check robots.txt for a `Disallow: /` carried over from the staging configuration.

Check that HTTP authentication protecting the staging environment is not still in front of production.

This is the single most damaging item on the list, and the one most often missed, because the site works perfectly for anyone who visits it directly.

Check the canonical tags point at production rather than at the staging hostname, which is the same class of leftover and equally invisible.

The certificate must cover every hostname that serves the site, including the one that only redirects. A certificate for `www` alone breaks the apex before its redirect can run.

Check the chain is complete. A server sending its leaf certificate without the intermediate works in browsers that cached it elsewhere and fails in clients that did not.

Check the expiry date and that renewal is automated and monitored — an automated renewal nobody watches fails silently.

Look for mixed content: a single plain-HTTP script or stylesheet is blocked, and the padlock disappears regardless of how good the certificate is.

If this replaces an existing site, every old address needs a destination before launch, not after the 404s appear.

Build the list from the old sitemap, a crawl of the old site, server logs and Search Console. The sitemap alone always misses the URLs that only exist in links and bookmarks.

Each should return a single 301 to the equivalent page, not a chain and not the home page.

Where no equivalent exists, 404 or 410 is the honest answer. A redirect to an unrelated page is treated as a soft 404 and helps nobody.

Titles and meta descriptions present and distinct per page. Missing ones are recoverable; duplicated ones across a whole template are a template fix.

A sitemap that parses and lists only canonical, indexable URLs that return 200.

Analytics and consent configured so that nothing non-essential loads before a visitor answers.

Security headers, which cost one configuration block and are easier to set before anyone depends on the current behaviour.

A 404 page that returns status 404 rather than 200, which is the thing most easily broken by a client-side router.

Open Graph tags with an absolute image URL, because the first share of a new site is usually within hours of launch and the preview is cached by each platform afterwards.

A crawl covers most of this mechanically. VeriFixScan reports `seo.noindex` and `seo.robots_txt` for the staging-directive problem, which is the one worth running twice.

`transport.https`, `transport.certificate_coverage` and `transport.mixed_content` cover the HTTPS tier, including the name-coverage case that breaks the apex.

`availability.status_classification` and `availability.error_pages` confirm the site answers and that a missing page returns 404 rather than 200.

Run it against the real production hostname once DNS points there, not against a preview URL. A preview deployment has different hostnames, different certificates and frequently different headers.