Review the content as a first-time visitor
Read the main pages in the order a prospect is likely to encounter them. Can you identify the business, its services, the intended audience and the next step? Check contact details, authorized images and factual claims. Remove placeholder sections and unsupported testimonials. Review the actual mobile layout rather than assuming a desktop screenshot represents it. A professional launch depends on useful information as well as considered typography and color.
Follow every important journey
Test navigation, direct page visits, browser refresh, forms, telephone links, booking, login and the publishing workflow. A booking page should display the real configured scheduling experience and retain a usable fallback when the provider is blocked. Confirm that an enquiry is saved and visible to the intended administrator. Test invalid inputs as well as successful actions. Keep account-specific checks, such as actual email receipt, separate from simulated or local application tests.
Check the public and private boundary
Drafts, future articles, private client records, passwords, database files and backups must not become publicly downloadable. Keep private application data outside the document root where possible and verify attempted direct access. Test role permissions on the server rather than only hiding buttons. Review session behavior, CSRF protection and upload restrictions. Automated checks provide evidence for the cases exercised, not a complete security certification. A production security review may require a separately agreed scope.
Preserve the useful search paths
Inventory important existing URLs before replacing an old website. Retain useful routes or map them to genuinely relevant replacements with specific redirects. Check that successful pages return the intended status, missing pages return a real 404 and canonical redirects do not loop. Review unique titles, descriptions, heading structure and internal links. Google recommends testing site moves and monitoring their effects rather than treating a sitemap as the whole migration plan. Read Google's URL-move guidance.
Measure performance in the right environment
Large images, heavy scripts and unstable layouts can undermine a good design. Reserve image dimensions, avoid unnecessary third-party scripts and test representative pages. Core Web Vitals describe loading, interaction and visual stability, but local lab results are not the same as real-user field measurements. Record the tool, device conditions and environment with any reported score. Do not label a source-code review as a measured performance result. Read the Web Vitals overview.
Keep the launch reversible
Take a full protected backup of application code and private data, including the keys required to use encrypted settings. Verify the folder layout and hosting capabilities. Document how to restore the previous site and who is authorized to decide on a rollback. A CMS content export may omit users, settings, credentials and application code, so it should not be mistaken for a complete hosting backup. Avoid copying test databases or private archives into publicly served folders.
Switch discoverability only after review
Staging noindex settings can be useful during review but do not make a website confidential. Use actual access protection when the staging environment must be private. After approval, remove the intended staging restrictions, verify eligible public pages in the sitemap and review the site while signed out. Search account ownership and sitemap submission require the owner's actual accounts. Explore website development, QA testing and maintenance for the work behind a controlled launch.