The checklist. Every site ships through it.

Every address loads over HTTPS, and HTTP forwards to it

Without HSTS a browser can still try plain HTTP first. Preload only once every subdomain is on HTTPS.

curl -I on the http and https address

Every page has its own title and description

Duplicate titles make pages compete in search and read the same in results. The page language is set too.

View source on each template, or a crawl

Each page names itself as the canonical address

Without it, www, non-www and tracking-parameter copies split a page's signals between them.

View source; crawl for missing canonicals

robots.txt lets Google in and keeps staging out

A staging or workers.dev copy left indexable competes with the real site. One stray Disallow can hide it all.

Open /robots.txt; check noindex on preview hosts

The sitemap lists every real page, once

Google reads it to find pages. Redirected or non-canonical addresses in it waste the crawl.

Learned Nov 2026: lastmod now moves only when a page's words change, so Google can trust the date.

Open /sitemap.xml; named in robots.txt

The favicon and app icons are all in place

Old browsers ask for /favicon.ico by exact path. iOS needs a 180 px icon with no transparency.

curl -I /favicon.ico; add to a phone home screen

A link shared anywhere shows a proper preview

A 1200 × 630 image under 300 KB works in WhatsApp, LinkedIn and X. WhatsApp drops images over 600 KB.

Real test sends; LinkedIn Post Inspector

The business and the site are described in structured data

Organization and WebSite markup feeds the site name in search. Stores add price and stock.

Google Rich Results Test on each template

Old addresses forward to new pages; unknown ones 404

A missing page served as 200 is a soft 404, and old addresses without forwards lose their rankings in a move.

curl a made-up address; test the redirect map

The site is fast on a mid-range phone

Targets: LCP 2.5 s, INP 200 ms, CLS 0.1. A lazy-loaded hero image is the usual LCP miss.

Learned Oct 2026: preloading the hero at high priority took one home page's LCP from 2.7 s to about 2.4 s.

Lighthouse five-run median; PageSpeed Insights

Everything works by keyboard, with visible focus

Includes alt text, 4.5:1 text contrast, 24 px tap targets and labelled form fields.

Learned Oct 2026: small orange text read 3.4:1; a darker shade for small text brought it to 5.2:1.

Tab through the main flow; Lighthouse accessibility

Security headers are set on every response

A content security policy, nosniff, referrer and permissions policies and framing control close common holes.

Learned Oct 2026: a preview sent none of them yet Lighthouse still scored 100. Workers and static files each need the list.

Header scan; Mozilla Observatory

A security contact file is published

security.txt gives researchers a real address to report to, with an expiry less than a year out.

Open /.well-known/security.txt

The domain's email is set up and the domain is locked

SPF, DKIM and DMARC keep your mail out of spam. Registrar lock and auto-renew stop a lapsed domain.

DNS lookups for SPF, DMARC and MX; registrar page

Privacy, terms and contact details are live

Indian company sites carry the Companies Act disclosures. Stores add e-commerce and Legal Metrology details.

Learned Nov 2026: analytics went live while the policy still said no cookies. It now names every tool before its tag ships.

By eye on the footer and policy pages

No tracker fires before consent where the law needs it

EU, UK and Swiss visitors need consent for ad pixels and identifying analytics. India has no dedicated cookie rule.

Learned Nov 2026: events now queue until the region check, then send or drop, so none fires early.

Load the site clean and watch the network tab

Analytics fire on the live site, with one goal defined

A launch with no conversion event cannot say whether the site works.

Learned Nov 2026: a tag set to load after the load event never loaded, and headless checks never reach GA4.

One real visit in Realtime; a headless request capture

Search Console and Bing know the site

A Domain property verified by DNS TXT covers every subdomain and survives a change of host.

Search Console property and sitemap status; Bing import

Every form is protected, tested and its leads stored

Spam protection, server checks and a stored copy mean an email outage loses no lead.

Learned Oct 2026: tests for a lead route failed 4 times on the old code, which proves they test something.

Submit from the live domain to a monitored inbox

An uptime monitor watches the home page and the key flow

Checkout or the form endpoint can break while the home page stays up.

UptimeRobot, Better Stack or Cloudflare Health Checks

A handover sheet lists accounts, DNS and access

It records where credentials live (never the values), every DNS record, property ids and who has access.

Reviewed with the client at handover

Search Console shows the sitemap read, with no errors

Request indexing for the home page and the pages that earn money.

Search Console coverage and URL Inspection

Real visitor speed is recorded from day one

Lab scores are a guess; field data from real visits is what Google judges.

Cloudflare Web Analytics; CrUX once traffic allows

Share the link in WhatsApp, LinkedIn and X once

Caches hold the first preview they saw, so a bad one sticks until refreshed.

Real sends; LinkedIn Post Inspector refresh

Rich Results Test passes on each template

One template with a warning repeats it on every page built from it.

Google Rich Results Test

Crawl the whole site for broken links

Launch week is when old links and typos surface, and Google sees them first.

A crawler over every page

Analytics numbers look plausible, own visits filtered out

Your own testing inflates early numbers, and a misfiring source hides what works.

GA4 sources and conversion events

Email authentication reports are arriving and read

Reports show who sends as your domain. Tighten the policy once real mail aligns.

DMARC report inbox

Trigger the uptime alert once and see who gets it

An alert that reaches nobody who acts is the same as no monitor.

Pause the check on purpose; see the message land

Watch a few recordings for dead clicks and broken layouts

Real sessions show what a test never will, with consent respected.

Heatmap or recording tool, a few sessions

Take the first backup

Shopify makes none: export products, customers and orders, and download the theme. Code goes in git.

Export files saved; a tagged git release

The sort menu reorders the page.

Fraghill, Oct 2026: on Shop All the sort menu did nothing; its script built the address with the wrong URL object.

Click every sort option on the live store

Every product you stock is on the page.

Fraghill, Sep 2026: the gifting page showed 12 of 14 sets, because its section had a limit of 12.

Count products on the page against the catalogue

Every size shows, with its price.

Fraghill, 2026: two of three sizes were invisible on all 35 products, because the size picker matched exact strings.

Check each product's size picker and card price

Add to Cart sits on a phone's first screen.

Measured at 390 by 664 px on the heaviest products: a long option list or a two-line note can push it below the fold.

Phone first-screen scan

The sticky Add to Cart bar shows up.

Kala Curry, Sep 2026: a custom footer lost the id the theme's script looks for, so the bar never showed.

Scroll a product page on a phone

Offers are live text, never part of the banner image.

Fraghill, Oct 2026: a Diwali banner had its offer lines baked into the art and the 2:1 hero cut them off.

Resize the hero to desktop and phone shapes

Tables and stacked cards show no hairlines at browser zoom.

Qurist, Oct 2026: a comparison table showed seams between rows at 125 to 175% zoom. 3 to 4 per table, now 0.

Zoom seam scan

One tap adds one item.

Fraghill, Sep 2026: Buy it now added a gift set twice because its script loaded twice. Now one add per click on 13 paths.

Count cart adds at the network on desktop and phone

A quantity typed in the cart reaches checkout.

Fraghill, Sep 2026: typing 1 over 2 and tapping Checkout opened checkout with 2.

Edit a quantity by typing, then go to checkout

Free shipping is judged the way checkout judges it.

Fraghill, Aug 2026: checkout tested the free-shipping line after discounts, so a set bought with the welcome code paid postage.

Test the line with and without a discount code

The price on the page is the price charged.

Qurist: every bundle change is checked four ways, because the shown and charged prices can split.

Admin, storefront data, rendered page and a real cart

What the store attaches to a cart line survives checkout.

Fraghill, Sep 2026: a hidden line property on each quiz pod survived checkout; 29 orders matched to a quiz click in a month.

Read the order's line properties after a test buy

The checkout button wears the brand's colours.

Fraghill, Sep 2026: the checkout app's button wore the old brand's navy and sat square beside rounded buttons.

Store UI audit

The hero image paints first.

Fraghill: the first slide paints before any script runs; the quiz's 184 KB scene library loads after its first question.

Lighthouse LCP element and request order

Nothing above the fold animates.

Qurist, Sep 2026: a hero heading stuttered because app scripts held the main thread for nearly two seconds of every load.

Frame trace of the first load

Apps nobody uses come off.

Qurist: an audit of every installed app took nine unused ones off the store and off the bill.

Installed apps list against the scripts the page loads

The lead form loads fast, and every lead is stored.

Qurist, Aug 2026: the consultation form took 12.4 s to appear; its replacement takes 3.8 and stores each lead.

Cold load timing; submit a test lead

Reveal masks leave room so no letter is cut

Oct 2026: a portfolio hero cut the e off 'the' and the p off 'skip', because each word's mask was too narrow.

Automated text check at desktop and phone widths

Headings and ledes wrap only when the line cannot fit

Oct 2026: forced line breaks left home headings in short lines with plenty of room beside them.

Measure at 1440 and 1280 px; by eye

Set height:auto wherever CSS sizes an image by its width

Oct 2026: brand cards drew 856 px tall over their logos, and 240 px icons were drawn 63 by 240.

Check each image's drawn shape against its file

End every grid on a full row at every width

Oct 2026: adding one logo left it alone in the last row, at 5 across on desktop and 3 on a phone.

By eye at 1440 and 390 px

Leave room under the last row for a fixed bottom bar

Oct 2026: a fixed dock covered all 9 footer links on a phone and 4 of 9 on desktop.

Check for covered links at 390 and 1440 px

Set labels at 14px or more, weight 500, never tiny grey

Oct 2026: 11 to 12px grey capitals read as unfinished. Labels now sit at 14px in ink grey, 8.6:1 contrast.

By eye at 1440 and 390 px; Lighthouse contrast

Take every gap from one spacing scale

Oct 2026: one-off gaps of 28, 26, 56 and 104 px left text too close to images and too far from paragraphs.

By eye; a heading sits 3 to 4 times closer to what follows

Make every button read as a button

Oct 2026: buttons with a faint 8 to 14% border were missable. Now filled, or a 1.5 px ink ring at 18:1 contrast.

By eye; no border under 1.5 px or 3:1

Shoot screens at the device's real pixel density

Oct 2026: desktop shots squeezed into phone frames, and a 1,284 px shot stretched to 1,867, looked blurry.

Fail any picture drawn wider than its source

Capture a client's live site read-only, trackers blocked

Oct 2026: 61 plain page loads would have fired a client's ad pixel and counted as fake visits.

Learned Hiding a price app's classes hid every price too. Block the app's script instead.

Capture log lists blocked hosts and no tracker allowed

Size each picture by how it is drawn

Oct 2026: one srcset for every tile served 0.9 MB. Sizes per picture cut a phone's load from 873 to 624 KB.

Compare chosen srcset width with drawn width times density

A video's poster is its first frame

Oct 2026: a clip's last frame was saved as its poster, so the page jumped from the end to the start.

Extract frame one with ffmpeg and compare by eye

Size logos in a wall by visible area

Oct 2026: a shared box shrank square and thin-stroke logos, and file padding (12% on one) shrank them again.

Measure each file's ink box; check the wall by eye

Start what the first screen does not need later

Oct 2026: moving smooth scroll, reveals and a WebGL field to idle cut blocking time from about 2.2 s to under 30 ms.

Learned Oct 2026: 37 decorative inline SVGs were 28 KB of one home page's HTML. As files they load near view.

Long tasks in a DevTools trace; Lighthouse blocking time

Judge speed on a five-run median, old against new in turn

Oct 2026: one build read 96, 79, 96, 63 and 91 in five runs, and moved from 95 to 84.5 within an hour.

Lighthouse five runs; alternate old and new builds

Heavy third-party tags load on first interaction

Nov 2026: gtag.js is 180 KB and, loaded at idle, still showed in Lighthouse blocking time.

Network list on a fresh load shows no tag request

Every number, logo and badge traces to its source

Nov 2026: a rank remembered as top 0.1% was top 1% in the issuer's own emails, so the site says 1%.

Each claim against its source; logo files carry a source

Read every screenshot for client names and open deals

Oct 2026: a screenshot of an internal tool named an open deal and came off the page before launch.

By eye, every image on the page

Every page ends on the main action

Oct 2026: the call button sat on 4 of 33 pages, and every lead was logged with the same button id.

Check each closing block and a test lead's button id

Never animate a price, percentage or date

Oct 2026: a count-up showed ₹492 for ₹495 and 2,332 for 2,344 for a moment after the tile came into view.

Frame grab 700 ms after the tile enters view

Snapshot a page's SEO facts before a redesign, then diff

Oct 2026: a case-study redesign kept every part of the text (1,417 words became 1,487); only heading numbers and the share image changed.

Before and after snapshot of title, headings, links, schema

Unlisted pages answer 404 on live until the client agrees

Nov 2026: an unapproved case study answered 200 on the public domain: noindex, but open to anyone with the address.

Request each held path on live and on staging

Bot Fight Mode stays off if you want AI citations

Nov 2026: its script checks cannot be switched off on the Free plan, so it went off to keep AI crawlers reading the site.

Cloudflare bot settings read through the API

Every live deploy pings IndexNow

Nov 2026: one request tells Bing, Yandex, Seznam, Naver and Yep which pages changed, the moment they change.

Dry run confirms the key file is live; 202 on send

Widgets built in script keep their content in the HTML

Oct 2026: an AI console's situations and links stay in the HTML, so agents, crawlers and script-off visitors still see them.

Look with script off; agent-readiness check

Check a new class name against the site's before using it

Oct 2026: a kit's .logo and .note restyled the home's brand cards, and a crop class .top hid every tile label.

Search the stylesheets for the name first

One deploy command does every after-step

Nov 2026: IndexNow, the page ledger and Search Console were steps to remember. One command now builds, deploys and checks.

The run exits 0 with every page check at 200