WordPress Launch Checklist

An interactive pre-launch checklist for WordPress sites covering settings, security, SEO, performance, content, legal and testing.

Runs in your browser

Progress

0 of 44 items complete · 0%

Priority

Your progress is saved in this browser only, so you can close the page and continue later.

  • Essential

    Settings → Reading. Left checked, WordPress sends noindex on every page and the site will not appear in Google. The most common launch mistake.

  • Essential

    Settings → Permalinks — usually “Post name” (/%postname%/). Decide before launch: changing it later requires redirects for every URL.

  • Essential

    Settings → General. Replace the default “Just another WordPress site” tagline — it can appear in feeds, themes and search results.

  • Recommended

    Use a city (e.g. “London”) rather than a UTC offset so daylight saving time is handled and scheduled posts publish on time.

  • Essential

    Settings → General. Security notices, update failures and recovery-mode links are sent here — not to a developer who leaves after launch.

  • Essential

    Run a serialisation-safe search-replace (wp search-replace 'https://staging.example.com' 'https://example.com' --all-tables), then check images and links.

  • Recommended

    Settings → Discussion. If the site does not need comments, disable them completely — the functions.php snippet generator has a snippet for it.

  • Essential

    Redirect http:// and the non-preferred www variant to one HTTPS URL with a 301. The .htaccess generator writes the rules for Apache.

  • Essential

    It is the first username attackers try. Create a new administrator, log in with it and delete the old account, attributing its content to the new one.

  • Essential

    Remove test accounts and give the client the lowest role that lets them do their work (often Editor).

  • Essential

    define( 'WP_DEBUG', false ); — or keep it on with WP_DEBUG_DISPLAY false and WP_DEBUG_LOG true so errors are logged, never shown.

  • Recommended

    Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.

  • Recommended

    Use a security plugin or host-level protection to throttle brute-force attacks on wp-login.php and XML-RPC.

  • Essential

    Remove inactive plugins and themes (keep one default theme), sample pages, “Hello world!” and the sample comment.

  • Recommended

    Put staging behind a password and noindex it so it cannot compete with the live site in search results.

  • Essential

    Every important page needs its own title (≈50–60 characters) and description. Draft them with the Meta Tag Generator.

  • Essential

    Remove any staging Disallow: / and reference your sitemap. Build a clean file with the robots.txt generator.

  • Essential

    WordPress serves /wp-sitemap.xml (SEO plugins use /sitemap_index.xml). Submit it in Search Console and Bing Webmaster Tools.

  • Essential

    Use a Domain property in Search Console so every protocol and subdomain is covered.

  • Essential

    Map old URLs to their new equivalents with 301 redirects to keep rankings and backlinks. Create them with the Redirect Generator.

  • Recommended

    Set a default 1200×630 share image so links look good on Facebook, LinkedIn and Slack — see the Open Graph Generator.

  • Recommended

    Organization or LocalBusiness markup on the home page, Article on posts, Product on shop pages. Test it with Google’s Rich Results Test.

  • Essential

    Use the host’s server cache or a caching plugin, and exclude cart, checkout and account pages on WooCommerce sites.

  • Essential

    Resize oversized uploads, convert to WebP/AVIF and make sure images have width and height attributes to prevent layout shift.

  • Recommended

    A CDN serves static files (and optionally full pages) from locations near visitors, reducing load times worldwide.

  • Essential

    Run PageSpeed Insights on the home page and each main template; aim for good LCP (< 2.5 s), INP (< 200 ms) and CLS (< 0.1).

  • Essential

    Search the database for “lorem”, “ipsum”, “example” and “TODO”, and replace stock images that still show watermarks.

  • Recommended

    Check spelling, phone numbers, addresses, prices and that every call-to-action button goes somewhere.

  • Recommended

    Include search, links to key pages and a way to contact you instead of a dead end.

  • Essential

    Appearance → Customize → Site Identity (or Settings → General in block themes). Generate every size with the Favicon Generator.

  • Essential

    Crawl the site and fix any links that still point to staging, localhost or deleted pages.

  • Essential

    Submit each form, confirm the notification arrives (check spam), the auto-reply works and entries are stored.

  • Essential

    PHP mail() is often rejected or marked as spam. Send through an SMTP or API provider with SPF, DKIM and DMARC set up on the domain.

  • Essential

    Settings → Privacy can generate a starting point. Link it in the footer and from every form that collects personal data.

  • Essential

    Visitors from the EU and UK must opt in before non-essential cookies (analytics, ads, embeds) are set.

  • Recommended

    Online shops need terms and returns information; some countries (e.g. Germany) require an imprint page.

  • Essential

    Check real-time reports after a test visit, exclude your own traffic and set up conversion goals for forms and purchases.

  • Essential

    Daily database and file backups stored away from the server, plus a manual backup right after launch.

  • Recommended

    A free monitor that checks every few minutes tells you about outages before your visitors do.

  • Essential

    Pay special attention to Safari on iOS, which often differs in fonts, sticky headers and form controls.

  • Essential

    Check menus, tap targets, forms and tables, and that nothing scrolls horizontally.

  • Essential

    Describe what the image conveys; leave alt empty for purely decorative images.

  • Recommended

    Tab through the page: menus, modals and forms must be usable without a mouse and the focus must always be visible.

  • Recommended

    Body text needs a contrast ratio of at least 4.5:1, and each page should have one H1 followed by logically nested headings.

Export report

The report lists every item as a Markdown task (- [x] done, - [ ] not done) and renders nicely in GitHub, Notion, Obsidian and most ticket systems.

Why use a WordPress launch checklist?

Launch day is when small oversights become expensive. A forgotten “Discourage search engines” checkbox keeps a site out of Google for weeks, a missing redirect map throws away years of rankings after a redesign, and a contact form that cannot send email loses leads silently. None of these are hard to fix — they are just easy to forget when everyone is focused on the design.

This checklist collects 44 pre-launch checks in the order most teams work through them: WordPress settings, security, SEO, performance, content, legal pages, analytics and backups, and finally cross-browser, mobile and accessibility testing. Each item explains why it matters and how to do it, and links to the generator on this site that handles the task when there is one.

Items are tagged Essential (do not launch without it) or Recommended (do it at launch or in the first week). Progress is saved in your browser, and the exported Markdown report doubles as a sign-off document for clients.

How to use the WordPress Launch Checklist

  1. Start a few days before launch on the staging site — most items can be completed there. Filter by Essential if time is short.
  2. Tick items as you go; groups show their own progress and can be collapsed when finished.
  3. On launch day, re-check the items that change when the domain changes: search engine visibility, URLs in the database, SSL, redirects, robots.txt and the sitemap.
  4. Add the site name, launch date and notes, then copy or download the Markdown report as a record of what was verified.

Example

Typical wp-config.php constants for a production launch:

define( 'WP_DEBUG', false );
define( 'DISALLOW_FILE_EDIT', true );
define( 'WP_POST_REVISIONS', 10 );
define( 'WP_ENVIRONMENT_TYPE', 'production' );

Launch-day order of operations

  • Take a final backup of staging and put the old site (if any) into maintenance mode.
  • Migrate files and database, then run a serialisation-safe search-replace of the staging URL.
  • Install SSL, force HTTPS and the canonical host, and deploy the redirect map from old URLs — see the WordPress Redirect Generator.
  • Uncheck “Discourage search engines”, check robots.txt and submit the sitemap in Search Console.
  • Purge all caches, test forms and checkout, and watch the error log and analytics for the first 48 hours.

Frequently Asked Questions

What is the most common WordPress launch mistake?

Leaving Settings → Reading → Discourage search engines from indexing this site checked after moving from staging. It adds a noindex robots meta tag to every page, so Google drops or never indexes the site.

Do I need redirects if I am launching a redesign on the same domain?

Yes, whenever any URL changes — new slugs, a different permalink structure, merged pages or a new shop structure. Map every old URL that has traffic or backlinks to its new equivalent with a 301 redirect.

Is the progress shared with my team?

No. Progress is stored in your browser only. To share it, export the Markdown report and paste it into your project tool or send it to the client.

Which items can be done on staging before launch?

Nearly all of them: content, forms (with a test mail catcher), security hardening, caching rules, image optimisation, accessibility and browser testing. Domain-dependent items — SSL, search engine visibility, sitemap submission and redirects — must be re-checked on the live domain.

What should I do after launch?

Switch to a regular maintenance routine: backups, updates, security and performance checks. The WordPress Maintenance Checklist organises them by weekly, monthly and quarterly frequency.