--- title: "Website and Shopify launch checklist · Anirudh Goel" description: "75 checks every site and Shopify store goes through: before launch, the first week, for stores, and lessons from real builds." canonical: https://anirudhgoel.xyz/checklist updated: 2026-11-03 site: "Anirudh Goel" language: en --- Checklist · 75 checks # The checklist. Every site ships through it. Before launch, the first week, the store fixes, and the rules added each time something broke. Tick the ones your site passes; the ticks stay in your browser. ## Before launch 21 checks every site passes before the domain points at it. Nothing ships with one open. 1. 01 ### Every address loads over HTTPS, and HTTP forwards to it Without HSTS a browser can still try plain HTTP first. Preload only once every subdomain is on HTTPS. curl -I on the http and https address 2. 02 ### Every page has its own title and description Duplicate titles make pages compete in search and read the same in results. The page language is set too. View source on each template, or a crawl 3. 03 ### Each page names itself as the canonical address Without it, www, non-www and tracking-parameter copies split a page's signals between them. View source; crawl for missing canonicals 4. 04 ### robots.txt lets Google in and keeps staging out A staging or workers.dev copy left indexable competes with the real site. One stray Disallow can hide it all. Open /robots.txt; check noindex on preview hosts 5. 05 ### The sitemap lists every real page, once Google reads it to find pages. Redirected or non-canonical addresses in it waste the crawl. **Learned** Nov 2026: lastmod now moves only when a page's words change, so Google can trust the date. Open /sitemap.xml; named in robots.txt 6. 06 ### The favicon and app icons are all in place Old browsers ask for /favicon.ico by exact path. iOS needs a 180 px icon with no transparency. curl -I /favicon.ico; add to a phone home screen 7. 07 ### A link shared anywhere shows a proper preview A 1200 × 630 image under 300 KB works in WhatsApp, LinkedIn and X. WhatsApp drops images over 600 KB. Real test sends; LinkedIn Post Inspector 8. 08 ### The business and the site are described in structured data Organization and WebSite markup feeds the site name in search. Stores add price and stock. Google Rich Results Test on each template 9. 09 ### Old addresses forward to new pages; unknown ones 404 A missing page served as 200 is a soft 404, and old addresses without forwards lose their rankings in a move. curl a made-up address; test the redirect map 10. 10 ### The site is fast on a mid-range phone Targets: LCP 2.5 s, INP 200 ms, CLS 0.1. A lazy-loaded hero image is the usual LCP miss. **Learned** Oct 2026: preloading the hero at high priority took one home page's LCP from 2.7 s to about 2.4 s. Lighthouse five-run median; PageSpeed Insights 11. 11 ### Everything works by keyboard, with visible focus Includes alt text, 4.5:1 text contrast, 24 px tap targets and labelled form fields. **Learned** Oct 2026: small orange text read 3.4:1; a darker shade for small text brought it to 5.2:1. Tab through the main flow; Lighthouse accessibility 12. 12 ### Security headers are set on every response A content security policy, nosniff, referrer and permissions policies and framing control close common holes. **Learned** Oct 2026: a preview sent none of them yet Lighthouse still scored 100. Workers and static files each need the list. Header scan; Mozilla Observatory 13. 13 ### A security contact file is published security.txt gives researchers a real address to report to, with an expiry less than a year out. Open /.well-known/security.txt 14. 14 ### The domain's email is set up and the domain is locked SPF, DKIM and DMARC keep your mail out of spam. Registrar lock and auto-renew stop a lapsed domain. DNS lookups for SPF, DMARC and MX; registrar page 15. 15 ### Privacy, terms and contact details are live Indian company sites carry the Companies Act disclosures. Stores add e-commerce and Legal Metrology details. **Learned** Nov 2026: analytics went live while the policy still said no cookies. It now names every tool before its tag ships. By eye on the footer and policy pages 16. 16 ### No tracker fires before consent where the law needs it EU, UK and Swiss visitors need consent for ad pixels and identifying analytics. India has no dedicated cookie rule. **Learned** Nov 2026: events now queue until the region check, then send or drop, so none fires early. Load the site clean and watch the network tab 17. 17 ### Analytics fire on the live site, with one goal defined A launch with no conversion event cannot say whether the site works. **Learned** Nov 2026: a tag set to load after the load event never loaded, and headless checks never reach GA4. One real visit in Realtime; a headless request capture 18. 18 ### Search Console and Bing know the site A Domain property verified by DNS TXT covers every subdomain and survives a change of host. Search Console property and sitemap status; Bing import 19. 19 ### Every form is protected, tested and its leads stored Spam protection, server checks and a stored copy mean an email outage loses no lead. **Learned** Oct 2026: tests for a lead route failed 4 times on the old code, which proves they test something. Submit from the live domain to a monitored inbox 20. 20 ### An uptime monitor watches the home page and the key flow Checkout or the form endpoint can break while the home page stays up. UptimeRobot, Better Stack or Cloudflare Health Checks 21. 21 ### A handover sheet lists accounts, DNS and access It records where credentials live (never the values), every DNS record, property ids and who has access. Reviewed with the client at handover ## The first week What to confirm in the seven days after launch, when real visitors start finding the gaps. 1. 01 ### Search Console shows the sitemap read, with no errors Request indexing for the home page and the pages that earn money. Search Console coverage and URL Inspection 2. 02 ### Real visitor speed is recorded from day one Lab scores are a guess; field data from real visits is what Google judges. Cloudflare Web Analytics; CrUX once traffic allows 3. 03 ### Share the link in WhatsApp, LinkedIn and X once Caches hold the first preview they saw, so a bad one sticks until refreshed. Real sends; LinkedIn Post Inspector refresh 4. 04 ### Rich Results Test passes on each template One template with a warning repeats it on every page built from it. Google Rich Results Test 5. 05 ### Crawl the whole site for broken links Launch week is when old links and typos surface, and Google sees them first. A crawler over every page 6. 06 ### Analytics numbers look plausible, own visits filtered out Your own testing inflates early numbers, and a misfiring source hides what works. GA4 sources and conversion events 7. 07 ### Email authentication reports are arriving and read Reports show who sends as your domain. Tighten the policy once real mail aligns. DMARC report inbox 8. 08 ### Trigger the uptime alert once and see who gets it An alert that reaches nobody who acts is the same as no monitor. Pause the check on purpose; see the message land 9. 09 ### Watch a few recordings for dead clicks and broken layouts Real sessions show what a test never will, with consent respected. Heatmap or recording tool, a few sessions 10. 10 ### Take the first backup Shopify makes none: export products, customers and orders, and download the theme. Code goes in git. Export files saved; a tagged git release ## For stores 17 conversion checks, each one a fix shipped on a real Shopify store, in the order a shopper meets it. 1. 01 ### The sort menu reorders the page. Fraghill, Oct 2026: on Shop All the sort menu did nothing; its script built the address with the wrong URL object. Click every sort option on the live store 2. 02 ### Every product you stock is on the page. Fraghill, Sep 2026: the gifting page showed 12 of 14 sets, because its section had a limit of 12. Count products on the page against the catalogue 3. 03 ### Every size shows, with its price. Fraghill, 2026: two of three sizes were invisible on all 35 products, because the size picker matched exact strings. Check each product's size picker and card price 4. 04 ### Add to Cart sits on a phone's first screen. Measured at 390 by 664 px on the heaviest products: a long option list or a two-line note can push it below the fold. Phone first-screen scan 5. 05 ### The sticky Add to Cart bar shows up. Kala Curry, Sep 2026: a custom footer lost the id the theme's script looks for, so the bar never showed. Scroll a product page on a phone 6. 06 ### Offers are live text, never part of the banner image. Fraghill, Oct 2026: a Diwali banner had its offer lines baked into the art and the 2:1 hero cut them off. Resize the hero to desktop and phone shapes 7. 07 ### Tables and stacked cards show no hairlines at browser zoom. Qurist, Oct 2026: a comparison table showed seams between rows at 125 to 175% zoom. 3 to 4 per table, now 0. Zoom seam scan 8. 08 ### One tap adds one item. Fraghill, Sep 2026: Buy it now added a gift set twice because its script loaded twice. Now one add per click on 13 paths. Count cart adds at the network on desktop and phone 9. 09 ### A quantity typed in the cart reaches checkout. Fraghill, Sep 2026: typing 1 over 2 and tapping Checkout opened checkout with 2. Edit a quantity by typing, then go to checkout 10. 10 ### Free shipping is judged the way checkout judges it. Fraghill, Aug 2026: checkout tested the free-shipping line after discounts, so a set bought with the welcome code paid postage. Test the line with and without a discount code 11. 11 ### The price on the page is the price charged. Qurist: every bundle change is checked four ways, because the shown and charged prices can split. Admin, storefront data, rendered page and a real cart 12. 12 ### What the store attaches to a cart line survives checkout. Fraghill, Sep 2026: a hidden line property on each quiz pod survived checkout; 29 orders matched to a quiz click in a month. Read the order's line properties after a test buy 13. 13 ### The checkout button wears the brand's colours. Fraghill, Sep 2026: the checkout app's button wore the old brand's navy and sat square beside rounded buttons. Store UI audit 14. 14 ### The hero image paints first. Fraghill: the first slide paints before any script runs; the quiz's 184 KB scene library loads after its first question. Lighthouse LCP element and request order 15. 15 ### Nothing above the fold animates. Qurist, Sep 2026: a hero heading stuttered because app scripts held the main thread for nearly two seconds of every load. Frame trace of the first load 16. 16 ### Apps nobody uses come off. Qurist: an audit of every installed app took nine unused ones off the store and off the bill. Installed apps list against the scripts the page loads 17. 17 ### The lead form loads fast, and every lead is stored. Qurist, Aug 2026: the consultation form took 12.4 s to appear; its replacement takes 3.8 and stores each lead. Cold load timing; submit a test lead ## Learned on real builds Rules added to the list after something went wrong once. The list keeps growing with every build. 1. 01 ### Reveal masks leave room so no letter is cut Oct 2026: a portfolio hero cut the e off 'the' and the p off 'skip', because each word's mask was too narrow. Automated text check at desktop and phone widths 2. 02 ### Headings and ledes wrap only when the line cannot fit Oct 2026: forced line breaks left home headings in short lines with plenty of room beside them. Measure at 1440 and 1280 px; by eye 3. 03 ### Set height:auto wherever CSS sizes an image by its width Oct 2026: brand cards drew 856 px tall over their logos, and 240 px icons were drawn 63 by 240. Check each image's drawn shape against its file 4. 04 ### End every grid on a full row at every width Oct 2026: adding one logo left it alone in the last row, at 5 across on desktop and 3 on a phone. By eye at 1440 and 390 px 5. 05 ### Leave room under the last row for a fixed bottom bar Oct 2026: a fixed dock covered all 9 footer links on a phone and 4 of 9 on desktop. Check for covered links at 390 and 1440 px 6. 06 ### Set labels at 14px or more, weight 500, never tiny grey Oct 2026: 11 to 12px grey capitals read as unfinished. Labels now sit at 14px in ink grey, 8.6:1 contrast. By eye at 1440 and 390 px; Lighthouse contrast 7. 07 ### Take every gap from one spacing scale Oct 2026: one-off gaps of 28, 26, 56 and 104 px left text too close to images and too far from paragraphs. By eye; a heading sits 3 to 4 times closer to what follows 8. 08 ### Make every button read as a button Oct 2026: buttons with a faint 8 to 14% border were missable. Now filled, or a 1.5 px ink ring at 18:1 contrast. By eye; no border under 1.5 px or 3:1 9. 09 ### Shoot screens at the device's real pixel density Oct 2026: desktop shots squeezed into phone frames, and a 1,284 px shot stretched to 1,867, looked blurry. Fail any picture drawn wider than its source 10. 10 ### Capture a client's live site read-only, trackers blocked Oct 2026: 61 plain page loads would have fired a client's ad pixel and counted as fake visits. **Learned** Hiding a price app's classes hid every price too. Block the app's script instead. Capture log lists blocked hosts and no tracker allowed 11. 11 ### Size each picture by how it is drawn Oct 2026: one srcset for every tile served 0.9 MB. Sizes per picture cut a phone's load from 873 to 624 KB. Compare chosen srcset width with drawn width times density 12. 12 ### A video's poster is its first frame Oct 2026: a clip's last frame was saved as its poster, so the page jumped from the end to the start. Extract frame one with ffmpeg and compare by eye 13. 13 ### Size logos in a wall by visible area Oct 2026: a shared box shrank square and thin-stroke logos, and file padding (12% on one) shrank them again. Measure each file's ink box; check the wall by eye 14. 14 ### Start what the first screen does not need later Oct 2026: moving smooth scroll, reveals and a WebGL field to idle cut blocking time from about 2.2 s to under 30 ms. **Learned** Oct 2026: 37 decorative inline SVGs were 28 KB of one home page's HTML. As files they load near view. Long tasks in a DevTools trace; Lighthouse blocking time 15. 15 ### Judge speed on a five-run median, old against new in turn Oct 2026: one build read 96, 79, 96, 63 and 91 in five runs, and moved from 95 to 84.5 within an hour. Lighthouse five runs; alternate old and new builds 16. 16 ### Heavy third-party tags load on first interaction Nov 2026: gtag.js is 180 KB and, loaded at idle, still showed in Lighthouse blocking time. Network list on a fresh load shows no tag request 17. 17 ### Every number, logo and badge traces to its source Nov 2026: a rank remembered as top 0.1% was top 1% in the issuer's own emails, so the site says 1%. Each claim against its source; logo files carry a source 18. 18 ### Read every screenshot for client names and open deals Oct 2026: a screenshot of an internal tool named an open deal and came off the page before launch. By eye, every image on the page 19. 19 ### Every page ends on the main action Oct 2026: the call button sat on 4 of 33 pages, and every lead was logged with the same button id. Check each closing block and a test lead's button id 20. 20 ### Never animate a price, percentage or date Oct 2026: a count-up showed ₹492 for ₹495 and 2,332 for 2,344 for a moment after the tile came into view. Frame grab 700 ms after the tile enters view 21. 21 ### Snapshot a page's SEO facts before a redesign, then diff Oct 2026: a case-study redesign kept every part of the text (1,417 words became 1,487); only heading numbers and the share image changed. Before and after snapshot of title, headings, links, schema 22. 22 ### Unlisted pages answer 404 on live until the client agrees Nov 2026: an unapproved case study answered 200 on the public domain: noindex, but open to anyone with the address. Request each held path on live and on staging 23. 23 ### Bot Fight Mode stays off if you want AI citations Nov 2026: its script checks cannot be switched off on the Free plan, so it went off to keep AI crawlers reading the site. Cloudflare bot settings read through the API 24. 24 ### Every live deploy pings IndexNow Nov 2026: one request tells Bing, Yandex, Seznam, Naver and Yep which pages changed, the moment they change. Dry run confirms the key file is live; 202 on send 25. 25 ### Widgets built in script keep their content in the HTML Oct 2026: an AI console's situations and links stay in the HTML, so agents, crawlers and script-off visitors still see them. Look with script off; agent-readiness check 26. 26 ### Check a new class name against the site's before using it Oct 2026: a kit's .logo and .note restyled the home's brand cards, and a crop class .top hid every tile label. Search the stylesheets for the name first 27. 27 ### One deploy command does every after-step Nov 2026: IndexNow, the page ledger and Search Console were steps to remember. One command now builds, deploys and checks. The run exits 0 with every page check at 200 ## Want it run on your site? I go through every point. [Book a 30-minute call ↗](https://cal.com/anirudh.goel/consultation?utm_source=portfolio\&utm_medium=site\&utm_campaign=checklist\&utm_content=closing) [WhatsApp me ↗](https://wa.me/917814769892?text=Hi%20Anirudh%2C%20I%27m%20on%20your%20checklist%20and%20want%20to%20talk%20about%20a%20project.) [More work →](https://anirudhgoel.xyz/projects) I reply the same working day. --- Site index for AI assistants: https://anirudhgoel.xyz/llms.txt Every page as one file: https://anirudhgoel.xyz/llms-full.txt