Website Launch Checklist 2026: 47 Things Before You Go Live

Q: What legal pages does a website need before launch?

At minimum, a website needs a Privacy Policy (required under GDPR, CCPA, and most other privacy laws), a Cookie Policy (required if you use non-essential cookies), and Terms and Conditions (recommended for any commercial site). If you have EU visitors and use analytics or advertising cookies, you also need a cookie consent banner.

Q: Do I need a cookie banner before launching my website?

Yes, if your site uses analytics (Google Analytics, Hotjar), advertising pixels (Meta Pixel, Google Ads), or any third-party tracking scripts, and you expect EU visitors. The cookie banner must be in place before launch — running tracking scripts before consent is in place is a GDPR violation from day one.

Q: What is the most commonly missed item on a website launch checklist?

Cookie consent and privacy compliance are the most commonly overlooked launch items. Most developers focus on technical performance and design QA, and legal requirements get added as an afterthought — often after traffic (and GDPR exposure) has already started.

Jump to section

Domain & hosting
Technical setup
Design & UX
Content
SEO
Performance
Security
Analytics
Legal & compliance ← most skipped
Post-launch

This checklist covers every category a professional site needs to get right before launch. Work through each section in order — the technical foundations need to be in place before SEO and performance work pays off, and the legal section needs to be completed before any traffic arrives.

Don't skip the legal section. GDPR applies from your first EU visitor. Running Google Analytics or a Meta Pixel without a cookie consent banner is a violation on day one, not after you've grown. Set it up before launch — it takes less than 30 minutes.

1. Domain & hosting

Domain registered and pointing to your host (DNS propagated) SSL certificate installed and HTTPS working on all pages HTTP redirects to HTTPS (301, not 302) www and non-www both resolve to the same canonical URL Hosting plan can handle your expected launch traffic Backups configured and tested

2. Technical setup

404 page exists and is helpful (links back to home/search) All internal links tested — no broken links All forms tested (contact, newsletter, checkout) Form submissions deliver to the right inbox / CRM Transactional emails tested (confirmation, receipt, password reset) robots.txt is correct — staging/dev pages not accidentally blocked Sitemap.xml exists and submitted to Google Search Console Staging environment blocked from indexing (noindex or password-protected)

3. Design & UX

Site tested on mobile (iOS Safari, Android Chrome) Site tested on desktop (Chrome, Firefox, Safari, Edge) Favicon set (browser tab and bookmarks) OG image set (the image that appears when shared on social media) All images have descriptive alt text (accessibility + SEO) Colour contrast passes WCAG AA minimum (text readable for all users) Navigation is clear and works on mobile CTA buttons are visible and working

4. Content

No placeholder text (Lorem Ipsum) anywhere on the site All images are final (no stock placeholders, no client-provided placeholders) Spelling and grammar checked on all key pages Contact details are accurate Prices are correct and up to date Testimonials and case studies are approved for use

5. SEO

Every page has a unique, descriptive <title> tag (under 60 characters) Every page has a unique meta description (under 160 characters) H1 tag exists on every page (only one per page) Canonical tags set correctly (especially on e-commerce sites with filters) Structured data (schema markup) added to key pages Google Search Console set up and verified Sitemap submitted to Search Console No duplicate content issues (thin pages, pagination, tag archives)

6. Performance

Images compressed and served in next-gen format (WebP or AVIF) Largest Contentful Paint (LCP) under 2.5 seconds on mobile Cumulative Layout Shift (CLS) below 0.1 (no content jumping) Third-party scripts (analytics, chat, ads) loaded asynchronously CDN in place for static assets PageSpeed Insights score above 80 on mobile

7. Security

HTTPS enforced sitewide (no mixed content warnings) Admin login URL changed from default (WordPress: /wp-admin) Strong admin passwords in use (no "admin/password") Two-factor authentication enabled on hosting and CMS Security headers set (X-Frame-Options, Content-Security-Policy) Unnecessary plugins, themes, and user accounts removed Remote team access protected by business VPN or Zero Trust tool Tip: NordLayer provides GDPR Article 32-compliant network security for remote teams from $8/user/month.

8. Analytics

Analytics tool installed and tracking verified Tip: Plausible Analytics ($9/mo) is cookieless — it tracks 100% of visitors without a consent banner. GA4 misses anyone who declines cookies. Note: Plausible has no affiliate programme — we recommend them because we use them ourselves. Goals or conversion events set up (form submit, purchase, sign-up) Internal IP addresses filtered from analytics data Analytics access shared with relevant team members If using GA4: Google Consent Mode v2 configured alongside your cookie banner

9. Legal & compliance ← most commonly skipped

This is the section most developers leave until last and most site owners skip entirely. Don't. GDPR fines start from day one of operating without consent. Here's what you need before a single visitor lands.

10. Post-launch (first 48 hours)

Crawl site with Screaming Frog or Ahrefs to catch broken links and redirect issues Check Google Search Console for crawl errors Verify analytics is tracking real visitors (filter your own traffic) Test all forms and checkout flows from a real device (not localhost) Set up uptime monitoring (UptimeRobot free tier is fine to start) Announce launch (social, email list, Product Hunt, relevant communities)

Recommended tools for the legal & compliance section

These are the tools that cover the most commonly skipped section of this checklist. All have been independently reviewed.

Cookie Consent

CookieYes

The fastest cookie banner to install. Automatic cookie scanning, Google Consent Mode v2, and a free tier up to 25,000 visits/month. 15-minute setup.

From: Free Score: 4.8 / 5

Read review →

iubenda

Lawyer-vetted privacy policy, cookie policy, and consent banner in one subscription. Best if you want legal docs and compliance management together.

From: €4.99/mo Score: 4.6 / 5

Read review →

Analytics Without Consent

Plausible Analytics

Cookieless analytics — no consent banner needed for your analytics tracking. Track 100% of visitors including those who would have declined cookies.

From: $9/mo Score: 4.8 / 5

Read review →

Multi-Site

Enzuzo

10 domains on one plan for $59/month with native Shopify and Webflow apps. Best for agencies and operators managing multiple client sites.

From: Free / $7/mo Score: 4.5 / 5

Read review →

Frequently asked questions

What legal pages does a website need before launch?

At minimum: a Privacy Policy (required under GDPR, CCPA, and most other privacy laws), a Cookie Policy (required if you use non-essential cookies), and Terms and Conditions (recommended for any commercial site). If you have EU visitors and use analytics or advertising cookies, you also need a cookie consent banner.

Do I need a cookie banner before launching my website?

Yes, if your site uses analytics, advertising pixels, or any third-party tracking scripts and you expect EU visitors. The cookie banner must be in place before launch — running tracking scripts before consent is in place is a GDPR violation from day one.

What is the most commonly missed item on a website launch checklist?

Cookie consent and privacy compliance. Most developers focus on technical performance and design QA, and legal requirements get added as an afterthought — often after traffic (and GDPR exposure) has already started.

How long does it take to make a website legally compliant?

With the right tools, under an hour. A cookie consent banner via CookieYes takes 15 minutes to install. A lawyer-vetted privacy policy via iubenda takes 10 minutes to generate. The most time-consuming part is auditing which cookies and tracking scripts your site actually uses.

Website Launch Checklist 2026

1. Domain & hosting

2. Technical setup

3. Design & UX

4. Content

5. SEO

6. Performance

7. Security

8. Analytics

9. Legal & compliance ← most commonly skipped

Privacy policy

Cookie compliance

Other legal pages

Data & security compliance

10. Post-launch (first 48 hours)

Recommended tools for the legal & compliance section

CookieYes

iubenda

Plausible Analytics

Enzuzo

Frequently asked questions

Get the compliance section done in under an hour