Checklists
Each list is an order of work, not new instructions. Every line points at the procedure that performs the check, so nothing is described twice and nothing drifts out of date in two places.
- Accessibility testing checklist Twenty-three checks in the order that stops you repeating work.
- API security review Twelve checks against an API you are allowed to test, ordered so that each one builds on what the previous established.
- API testing checklist Fifteen checks to run against an API before it goes out, each one a command you can paste and a result you can read.
- Caching and CDN review Eleven checks that answer one question in stages: is this response cached, by whom, for how long, and what happens when it goes stale.
- Core Web Vitals audit Ten checks for the three metrics a field report will quote at you, plus the measurements that explain them.
- Database migration checklist Fifteen checks around a schema or data migration, ordered by when the damage becomes expensive to undo.
- DNS migration checklist Thirteen checks around a nameserver or record change, in the order the clock forces.
- Email testing checklist Seventeen checks before a service starts sending mail, or before it changes how it sends.
- File upload testing checklist Fourteen checks in the order the bytes travel: what the client claims, what the server decides, what the disk holds, what the next reader gets.
- Form validation testing checklist Thirteen checks in the order a value travels: what the control does to it before anyone reads it, what the browser refuses to send, what the server decides, and what the person is left looking at when it fails.
- Load testing checklist Fifteen checks for a load test, in the order that keeps the result honest.
- Localization testing checklist Sixteen checks for a product that ships in more than one language, grouped by the three ways localization breaks.
- Login page testing checklist Twenty-five checks against a service you own or have written permission to test, on an environment where a mistake costs nothing.
- Payment gateway testing checklist Fifteen checks across the two halves of a payment integration that fail for different reasons.
- Pull request checklist Fourteen checks to run against a branch before it merges, grouped by what a green pipeline still lets through.
- Security headers review Ten checks over the response headers a browser acts on, grouped by what each one actually defends.
- Test environment checklist Sixteen checks on the environment a suite runs in, rather than on the code it tests.
- TLS and certificate review Thirteen checks that take a TLS deployment apart in the order the handshake builds it: what the server offers, what it agrees to, what it proves, and what it tells the browser to remember.
- Web performance checklist Fourteen measurements to take before a site goes live, in the order that keeps each one honest.
- Website launch checklist Eighteen checks that decide whether a site is safe to point a domain at.
- Website privacy and consent review Eighteen checks on what a site actually does with a visitor's data, as distinct from what its policy page says.