Website launch checklist
Eighteen checks that decide whether a site is safe to point a domain at. This is the cross-cluster list: transport, headers, cookies, delivery and the API behind the page, because a launch fails on whichever of those was nobody's job. Each item is a command with a result you can read, not an opinion. Work down it on the staging host first and again on the real hostname after DNS moves, because several of these answers change with the hostname and none of them change with your intentions.
18 checksabout 107 min end to end
The connection
- How to check SSL certificate expiry
The failure with a date on it. Everything else on this list degrades; this one takes the site down at a time you can predict and did not. - How to check certificate SAN
A new hostname at launch is exactly when the name list stops matching, and the failure is total for that name. - How to check certificate chain
A chain that resolves in your browser because of a cached intermediate will not resolve on a fresh client. - How to check TLS version of a website
Read what the server actually negotiates, not what the configuration file says it offers. - How to check HTTP to https redirect
The first request a visitor makes is usually plain HTTP, and it is the one the config forgets.
Headers and cookies
- How to check security headers
One pass that surfaces most of what the next four items confirm one at a time. - How to check if HSTS is enabled
Without it the redirect above can be stripped on the first visit, which is the visit that matters. - How to check CSP header
Launch is the last moment a policy can be tightened without breaking a page someone is already using. - How to check X-Content-Type-Options
Without nosniff a browser can execute a file the site meant to serve as data. - How to check if a site is vulnerable to clickjacking
Test the framing, not the header. The two disagree more often than anyone expects. - How to check if cookies are secure and HttpOnly
A session cookie without these flags is readable by script and sendable in the clear. - How to check SameSite cookie attribute
The default changed under everyone, so a cookie that worked last year may not survive a cross-site flow now.
Content integrity
- How to check if mixed content exists on a page
One plain-HTTP asset in a page served over TLS is blocked by the browser and reported by nobody. - How to check subresource integrity
A script loaded from a third party is code you did not write running on your origin.
Delivery
- How to check cache-control header
Get this wrong at launch and either nothing is cached or the wrong thing is cached until its max-age runs out. - How to check if gzip is enabled
The cheapest performance win, and the one a new proxy silently removes. - How to check redirect chain
A migration leaves hops behind, and each one is a round trip before the page starts.
The API behind it
- How to check CORS configuration
A reflected origin with credentials is account takeover, and it looks exactly like a working configuration.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.