B efore a WordPress website goes live, check six areas. These are indexing and domain, forms and links, content and SEO, legal pages, loading speed and accessibility, and security and backups. Most problems after launch come from forgotten settings. A ticked box in the reading settings keeps Google out, a contact form sends no emails, or the source code still links to the staging site. This checklist helps you find such errors before visitors notice them.
When Is a WordPress Website Ready to Go Live?
A WordPress website is ready when all content is approved, every page has been checked on smartphone and desktop, and forms, legal pages and the cookie banner work. Check this on the staging site while no visitor can see it yet. Plan the final review as a separate step with a fixed date, apart from the launch itself. If you only check on launch day, there is no time left to fix errors properly.
The Checklist Before Going Live
1. Indexing and Domain
Many staging sites are blocked for search engines. When the website moves to the live domain, this block often moves with it.
- Under Settings › Reading, the box “Discourage search engines from indexing this site” is unticked.
- The robots.txt does not block important areas, for example through a leftover disallow rule for the entire website.
- Under Settings › General, the WordPress Address and Site Address show the final domain with https.
- The database no longer contains references to the staging domain. Replace them with a tool that handles serialised data, for example WP-CLI search-replace.
- The versions with and without www and with http redirect via 301 to a single address.
- The SSL certificate is active and the browser reports no insecure content (mixed content).
- Password protection and maintenance mode of the staging site are switched off.
2. Forms, Emails and Links
A contact form that shows a success message but sends no email costs enquiries without anyone noticing. By default, WordPress sends emails through the PHP function mail(). These emails are not authenticated and often end up in spam or are rejected. Set up sending via SMTP and test every form with a real enquiry.
- Every form can be submitted, the notification arrives and the sender receives a confirmation.
- The sender address belongs to your own domain, and SPF and DKIM are set up in the DNS.
- Internal links point to the live domain and never to a 404 page. A crawler such as Screaming Frog lists all broken links.
- Phone numbers and email addresses are clickable and correct.
- The 404 page is designed and leads back to the most important pages.
- In a relaunch, every old URL redirects via 301 to its new counterpart. The details are in our SEO checklist for a website relaunch.
- Google Analytics records visits on the live domain. Check this in the real-time report.
3. Content and SEO
Placeholders survive until launch surprisingly often. Lorem ipsum in an accordion, a demo post from the theme or an image named “test-final2.jpg” look unprofessional and end up in the Google index.
- Every page has exactly one H1, followed by H2 and H3 without skipped levels.
- Every page has its own title of no more than about 60 characters and its own meta description of about 150 characters.
- Images have descriptive alt texts, decorative images an empty alt attribute.
- Demo content, sample pages and the “Hello world!” post are deleted.
- The texts are proofread, and names, prices and opening hours are correct.
- A favicon and a preview image for social media (Open Graph) are in place.
- On multilingual websites, all language versions are translated and linked via hreflang.
How We Check Websites Before Launch
At Graphix Island, a website only counts as finished once it has passed a complete quality review. We check every page from top to bottom, including the sections nobody worked on last. We look at the same page through the eyes of an art director, a UX designer, an SEO specialist and a developer in turn, because each role finds different errors. The art director notices uneven spacing between two sections, the SEO specialist a second H1 in the footer. Finally, we compare the new page with our finished service pages and answer one question. Would we publish this website as a reference project today? If the answer is not a clear yes, we keep working.
Checking Legal Pages, Speed and Security
4. Legal Pages and Data Protection
Within the EU, a business website needs a privacy policy that names every service in use, in line with the GDPR. In Germany, a full legal notice (Impressum) under Section 5 of the Digital Services Act (DDG) is mandatory from the first visitor. Non-essential cookies and tracking require prior consent, in Germany under Section 25 TDDDG. This checklist does not replace legal advice.
- The legal notice and privacy policy can be reached from every page with one click, also on smartphones.
- The cookie banner only loads analytics and marketing services after consent. Check this in the network tab of your browser’s developer tools.
- Google Fonts and other fonts are hosted on your own server. On 20 January 2022, the Munich Regional Court awarded a visitor damages because a website loaded Google Fonts from Google’s servers and transmitted his IP address (case no. 3 O 17493/20).
- Embedded videos and maps only load after a click or after consent.
- Forms link to the privacy policy.
5. Loading Speed, Mobile View and Accessibility
Google assesses loading speed with the Core Web Vitals. A Largest Contentful Paint of up to 2.5 seconds, an Interaction to Next Paint of up to 200 milliseconds and a Cumulative Layout Shift of up to 0.1 count as good. Measure the values with PageSpeed Insights for the homepage and the most important subpages, each for mobile devices.
- Images are compressed and uploaded in a suitable size, ideally as WebP.
- Caching is active, and after launch you clear the cache completely once.
- You have checked every page on a real smartphone. The shrunken browser view does not show all errors.
- Contrast is sufficient, buttons are clearly labelled and the page can be operated with the keyboard.
Since 28 June 2025, the European Accessibility Act has required many providers of online shops and other digital consumer services to offer accessible websites. In Germany, it applies through the Accessibility Strengthening Act (BFSG). Microenterprises with fewer than ten employees and an annual turnover of no more than two million euros are exempt for services.
6. Security and Backups
Security belongs in the final review, because bots scan a website for known vulnerabilities from day one.
- WordPress, theme and plugins are up to date, unused plugins and themes are deleted.
- No user is called “admin”. Administrators use strong passwords and two-factor authentication.
- Test accounts and access for external service providers are removed or reduced to the rights they need.
- In wp-config.php, WP_DEBUG is set to false so visitors see no error messages with file paths.
- An automatic backup runs daily to external storage, and you have tested the restore once.
Which checks protect your installation in the long run is explained in our article WordPress security checks.
What to Do Right After Going Live
Complete these steps on launch day and in the first week.
- Register the website in Google Search Console and Bing Webmaster Tools and submit the XML sitemap.
- Submit the homepage and the most important subpages for indexing via URL inspection in Search Console.
- Clear all caches, including at the host and in the CDN, and open the website in a private browser window.
- Submit every form on the live domain once more.
- Monitor crawl errors and 404 pages in Search Console over the first few weeks.
We handle the launch of every website we build as a WordPress agency, with a complete quality review before it goes live. We keep existing websites technically up to date with our WordPress support. If you are moving your website to a new host, we take care of the WordPress migration.
Frequently Asked Questions About Launching a WordPress Website
How long does it take to launch a WordPress website?
Once the final review on the staging site is complete, the technical switch to the live domain usually takes a few hours. If the DNS record of the domain changes, some visitors may only see the new website after several hours, depending on the settings.
Should I build WordPress on a staging site before launch?
Yes. On a staging site, you test changes without visitors or Google seeing half-finished pages. Many WordPress hosts offer staging directly in the customer area. Protect the staging site with a password and block it for search engines.
Why does my new website not appear on Google?
First check whether search engines are blocked under Settings › Reading or whether a noindex tag from the staging site is left over. If both are fine, register the website in Google Search Console and submit the sitemap. It often takes a few days to a few weeks until a new website is fully indexed.
Who is responsible for the legal notice and privacy policy?
The operator of the website, usually your company. An agency integrates the texts technically, but responsibility for the content stays with the operator. Generators from law firms or a review by a lawyer are suitable for the texts.
What is the difference between a launch and a relaunch?
At launch, a website becomes publicly available under its final domain. In a relaunch, the new website replaces an existing one. Redirects and keeping your rankings then become additional tasks.
Do I still need maintenance after launch?
Yes. WordPress, theme and plugins receive regular updates that close security gaps. Without maintenance, a website becomes outdated within a few months and vulnerable to attacks. Which tasks are involved is explained in our article on WordPress maintenance.
Published on
