A go-live checklist is not a substitute for architecture. It is how you catch the items that always slip: a staging password reused in production, a form with no spam control, backups that have never been restored. Walk this list with whoever can change DNS, hosting, and the CMS.
Access and secrets
Unique accounts. MFA on hosting, domain, Git, and CMS admin. No shared “webmaster” mailbox as the recovery email. Rotate API keys that were pasted into Slack. Confirm production env files are not in the public repo or web root. Revoke contractor SSH keys from discovery.
The site surface
HTTPS on apex and www. No directory listing. Error pages that do not leak stack traces. Admin URLs protected. Unused plugins and sample apps deleted. File uploads restricted. Contact and checkout forms validated server-side, with rate limits and a spam signal that is not a broken CAPTCHA.
Data you actually keep
Collect only what the product needs. Encrypt backups. Test a restore. Know where customer emails live—CRM, newsletter, hosting logs. If you take payments, stay on a PCI-ready provider and never store raw card data. Publish a privacy page that matches reality.
Cookies, third parties, and monitoring
Session cookies: Secure, HttpOnly, sensible SameSite. Tag managers and chat widgets should not get more access than they need. Turn on uptime and error monitoring. Know who gets the 3 a.m. alert. Schedule the first dependency update after launch so patching is a habit, not a crisis.
SpectrumX runs this pass before websites and web apps ship. If you want launch-ready delivery—not a scramble after the first spam flood—talk to us about web development.
