Launching a Webflow site for a client: the checklist

What usually breaks at handoff

The first five are launch blockers: while any of them fails, the score is capped at 49 however well everything else scores. Each one links to the full guide.

• Site not served over HTTPS (blocks launch): The page is not served over a secure (HTTPS) connection. Check: HTTPS.

• Noindex left on after launch (blocks launch): The page asks search engines to leave it out of their results. Check: Search indexing.

  Look at the site's SEO settings and at each page's own settings before you publish, including any option that keeps a page out of search.

• robots.txt blocks Google (blocks launch): robots.txt shuts out Google or every crawler, so search engines cannot crawl the site. Check: robots.txt.

• Canonical points to staging (blocks launch): The page tells search engines its real address is on another host, often staging, so the live page can drop out of Google. Check: Canonical.

  A canonical you typed into page settings or custom code keeps the address you typed. Search the project for the webflow.io address.

• Form posts to staging (blocks launch): A form on the page sends what visitors type somewhere other than the live site. Check: Form destination.

  Forms from another tool, or custom code that posts to a staging endpoint, keep posting there until you change them.

  # Webflow: select the Form Block, open the Settings panel and look at the
  # form's Action field. Leave it empty to use Webflow's own form handling,
  # or set your live endpoint (never a .webflow.io or staging address).
  # Publish again, send a test submission, then re-check.

• Placeholder text left in: The page still shows template filler text, such as dummy Latin copy or a leftover to-do marker. Check: Placeholder text.

• No sitemap: Search engines are given no list of the site's pages to crawl. Check: Sitemap.

  Generate the sitemap from the site's SEO settings, then publish again so it exists on the custom domain.

• No Open Graph image: Links shared in chat apps and social media show no proper preview. Check: Open Graph.

• Share image does not load: The picture meant for link previews does not load, so shared links show no image. Check: Share image loads.

• Mixed content on an HTTPS page: Some files on this secure page load over an insecure connection, so browsers block them or show a warning. Check: Mixed content.

  # Webflow serves its own images and scripts over HTTPS, so http:// URLs
  # come from code you added. Look in:
  #   Site settings > Custom code (head and footer code)
  #   each page's settings > Custom code
  #   every Embed element on the page
  # Change each http:// to https://, publish again, then re-check.

• Images missing alt text: Some images have no text description for screen readers and search engines. Check: Image alt.

• Missing HSTS header: Browsers are not told to always use the secure connection. Check: HSTS.

  Webflow sends this header on a connected custom domain, not on the webflow.io address, so check the live domain.

  # Webflow sends Strict-Transport-Security (HSTS) by default, but only on a
  # connected custom domain, never on *.webflow.io. Site settings > Publishing >
  # Advanced publishing options: keep HSTS on, publish to the custom domain,
  # and re-check that URL.

• Page can be framed: Other sites can show this page inside a frame to trick visitors into clicks. Check: Clickjacking protection.

  # Webflow: Site settings > Publishing > Advanced publishing options
  # Turn on "Use secure frame headers", then publish again.
  # Webflow then sends X-Frame-Options: SAMEORIGIN, which passes this check.

Moving an existing site?

If the client's old site was on WordPress or another platform, its old URLs need permanent redirects (301 or 308) to the new pages, or the search traffic they bring stops at a 404. Migration Repair maps them, puts the redirects in and checks them live, for $500 per site.