Our 20-point checklist before any website goes live

Our website launch checklist has 20 items, and every site we build passes all of them before the domain points at it. They cover four areas: legal pages, security, how search engines and AI assistants read the site, and whether a visitor can actually get in touch.

None of it is glamorous. Most of it is the work that gets skipped when a launch date is close, then shows up months later as a spam-filled inbox, a broken link preview, or a contact form that quietly stopped sending.

Why bother with a checklist?

Because websites rarely fail in dramatic ways. They fail in small, boring ones that nobody notices until a customer does.

In finance, month-end close runs on a checklist for the same reason. The errors that cost money are the small ones nobody looked at. A launch is no different.

Here is the full list, grouped by what each item protects.

Legal and trust

• Privacy policy. Says what personal information the site collects, why, and who to contact about it.
• Terms and conditions. Sets the ground rules for using the site and anything sold through it.
• Cookie consent banner. Tells visitors about analytics and tracking, and gives them a choice.

If you are unsure what a Canadian site actually needs here, we wrote a separate guide on privacy policies, cookies and CASL.

Security and forms

• Remove front-end secrets. No API keys, passwords or private tokens sitting in page code where anyone can read them.
• Enforce HTTPS. Every page loads over a secure connection, and plain HTTP redirects to it.
• Form validation. Fields check for sensible input before the form submits, so you don't get blank or broken enquiries.
• Spam protection. Forms filter out bots, so real enquiries aren't buried under junk.

How search engines and AI assistants read the site

• Meta titles and descriptions. Each page gets its own, written for the person searching rather than stuffed with keywords.
• Social preview image. When someone shares a link in a text or on Facebook, a proper image shows up instead of a random crop.
• Favicon. The small icon in the browser tab and in bookmarks.
• Sitemap and robots.txt. A map of the site for search engines, plus a robots.txt file that allows AI search crawlers in rather than blocking them.
• Image alt text. Short descriptions of images for screen readers and search engines.
• Analytics setup. GA4 installed and tested, so there is real data from day one instead of guesswork.

Speed and usability

• Image compression. Photos sized and compressed so they don't drag the page down.
• Page-speed check. The site is tested and fixed until it loads quickly on an ordinary phone connection.
• Colour-contrast fixes. Text is readable against its background, including for people with low vision.
• Mobile responsiveness. Every page checked on phone, tablet and desktop widths.
• Custom 404 page. A missing page points people back to something useful instead of a dead end.
• Broken-link check. Every internal and external link clicked and confirmed.

The one that matters most

• One clear call to action. Each page tells the visitor what to do next: call, book, request a quote. One action, not five competing ones.

That makes 20. The last item is the one most sites get wrong, because it is a decision rather than a technical task. If a page has no obvious next step, the other 19 items are mostly protecting a site that doesn't produce enquiries.

What goes wrong when items get skipped?

Can you run this checklist on your own site?

Yes, and you should, even if someone else built it. A few practical steps:

• Open your site on your phone with Wi-Fi off and see how it loads.
• Share your homepage link in a text to yourself and look at the preview.
• Submit your own contact form and confirm the message arrives.
• Visit a page that doesn't exist (add some random letters to your web address) and see what happens.
• Look for a privacy policy link in your footer.

If two or three of those fail, the rest of the list probably needs a look too.

Where Papaya fits

Every site we build is custom-designed from a blank page, hand-built, hosted on Cloudflare, and goes through this full checklist before launch. If you want a new site, or want your current one checked against the list, see our website services, how we work with Ontario businesses and our pricing, or send us your site.

Common questions

What should be on a website launch checklist?

At minimum: a privacy policy, HTTPS, working and spam-protected forms, page titles and descriptions, a sitemap, compressed images, a mobile check, analytics, and one clear call to action. Our checklist has 20 items across legal, security, search and usability.

Does a small business website need a cookie banner?

If the site uses analytics or advertising tracking, a cookie consent banner is the straightforward way to tell visitors and give them a choice. We include one on every site we launch.

How do I check if my website's contact form works?

Submit it yourself with a real email address and confirm the message arrives where you expect it. Test it again after any change to the site, because forms are one of the most common things to break quietly.