Production Website Launch & Pre-Flight QA Checklist

Submit test data to every live form: contact, quote calculator, careers, newsletter, and demo requests. Verify database storage and email delivery.

Ensure notifications route through dedicated transactional SMTP relays (Postmark, SendGrid, Amazon SES) rather than untrusted PHP mailer.

Confirm the prospect receives an immediate branded confirmation email within 60 seconds. Verify logo display, sender address, and no leftover placeholder copy.

Verify GA4 generate_lead, Google Ads conversion tags, and LinkedIn Insight pixel events fire exactly once per successful submission.

Test invalid email formatting, missing required inputs, and honeypot/Turnstile captcha triggers. Verify the form never wipes user input on error.

Verify phone numbers in header, footer, and contact sections open the native phone dialer on iOS/Android with correct country codes.

Audit primary page templates (Home, Services, Case Studies, Contact) in Chrome DevTools Console. Zero red TypeError or Uncaught ReferenceError exceptions allowed.

Verify no broken background images, missing font files (.woff2), or forgotten developer script tags causing 404/410 status codes in Network panel.

Test layout stability at 1440px, 1024px, 768px, and 390px widths. Ensure document.documentElement.scrollWidth === clientWidth with no unintended horizontal scrollbars.

Ensure tag managers, analytics, heatmaps, and chat widgets use async or defer attributes so third-party latency never blocks HTML parsing.

Ensure scroll-driven animations, parallax, and infinite loops gracefully revert to static displays when visitors enable reduced motion in OS settings.

Verify all regular text (under 18pt or 14pt bold) achieves at least 4.5:1 contrast against its immediate background container across both light and dark themes.

Ensure form input borders, button outlines, custom checkboxes, and standalone navigation icons meet WCAG 2.2 non-text contrast ratio of 3.0:1.

Navigate entire page using only Tab, Shift+Tab, and Enter. Every link, button, and form element must show a high-contrast focus indicator (never outline: none without fallback).

Verify exactly one H1 per page, sequential heading progression (no skipping from H2 to H4), and proper HTML5 structural tags (header, nav, main, footer).

Informative photos and charts require descriptive alt text. Purely decorative icons and shapes must include aria-hidden="true" or empty alt="" to avoid screen reader clutter.

Every input must have an explicit label element with for="[id]" or aria-label. Placeholders vanish during typing and cannot substitute for labels.

Confirm WordPress "Discourage search engines from indexing this site" is unchecked and robots.txt allows Googlebot crawl access. Leftover noindex wipes search presence.

Map every legacy URL with existing backlinks or search impressions to its exact modern counterpart. Never bulk redirect entire sites to the homepage.

Ensure every published URL contains a self-referencing canonical tag and unique, keyword-calibrated title and meta description without placeholder text.

Generate /sitemap.xml or sitemap_index.xml. Confirm all included URLs return HTTP 200 OK with no redirected or 404 links listed.

Verify og:image (1200×630 pixels), og:title, and og:description render with crisp brand assets when shared on LinkedIn, iMessage, and X/Twitter.

Hero banner images and videos must use modern WebP/AVIF formats, responsive srcset sizing, and fetchpriority="high" without lazy-loading above-the-fold assets.

All images, logos, SVGs, and iframe embeds must have explicit width and height attributes or CSS aspect-ratio rules to prevent content jumping during page render.

Verify server returns content-encoding: br or gzip for text assets, and sets cache-control: max-age=31536000 for immutable fonts, images, and compiled bundles.

Ensure mobile hamburger menus, accordion toggles, and form inputs react instantly under 200ms without heavy JavaScript execution freezes.

Lower Time-To-Live (TTL) on A and CNAME records 24 to 48 hours prior to launch. This ensures IP propagation happens in 5 minutes rather than 24 hours.

Record and preserve all existing MX (Google Workspace, Microsoft 365) and email TXT records. Switching DNS without copying MX causes company-wide email outages.

Verify TLS certificate is provisioned for both apex (domain.com) and www (www.domain.com). Force all plain HTTP traffic to 301 redirect to secure HTTPS.

Generate a complete standalone SQL database dump and wp-content archive stored in offsite cloud storage immediately prior to switching live DNS traffic.

Ensure current legal policies are accessible in the footer, accurately identifying company legal entity name, jurisdiction, and contact address.

If operating in or marketing to EU, California, or regulated states, confirm marketing and tracking scripts do not execute prior to explicit visitor consent.

Implement X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Strict-Transport-Security to prevent MIME sniffing and clickjacking.

Remove default "admin" user accounts, enforce multi-factor authentication (2FA) on all administrator accounts, and enable automated brute-force rate limiting.