Launching a WordPress site for a client: the checklist

What usually breaks at handoff

The first five are launch blockers: while any of them fails, the score is capped at 49 however well everything else scores. Each one links to the full guide.

• Site not served over HTTPS (blocks launch): The page is not served over a secure (HTTPS) connection. Check: HTTPS.

  Install the certificate through your host, then set both the WordPress Address and the Site Address under Settings, General to the https:// version.

• Noindex left on after launch (blocks launch): The page asks search engines to leave it out of their results. Check: Search indexing.

  Under Settings, Reading, make sure Discourage search engines from indexing this site is switched off. SEO plugins also have their own per-page noindex options.

• robots.txt blocks Google (blocks launch): robots.txt shuts out Google or every crawler, so search engines cannot crawl the site. Check: robots.txt.

  WordPress generates a robots.txt that allows crawling; a Disallow: / usually comes from an SEO plugin's robots.txt editor or a physical robots.txt file left from staging. Check both.

• Canonical points to staging (blocks launch): The page tells search engines its real address is on another host, often staging, so the live page can drop out of Google. Check: Canonical.

  SEO plugins write the canonical. A staging address in the plugin's settings, or in content copied from staging, carries across.

• Form posts to staging (blocks launch): A form on the page sends what visitors type somewhere other than the live site. Check: Form destination.

  Form plugins store their endpoints and notification settings in the database, so a copied staging site can still point at the staging address.

  <?php
  // Form plugins post to the site itself. If the action still names staging,
  // check Settings > General: WordPress Address and Site Address must be the
  // live domain. In a theme template, build the action from the site address:
  ?>
  <form action="<?php echo esc_url( home_url( '/contact/' ) ); ?>" method="post">

• Mixed content on an HTTPS page: Some files on this secure page load over an insecure connection, so browsers block them or show a warning. Check: Mixed content.

  Posts and widgets store full image addresses in the database, so old http:// URLs survive a move to HTTPS until you search and replace them.

  # Content saved before the site moved to HTTPS still says http://.
  # 1. Settings > General: WordPress Address and Site Address start with https://.
  # 2. Back up the database, then replace the old URLs. With WP-CLI:
  wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run
  # Run it again without --dry-run once the counts look right.
  # Without shell access, the Better Search Replace plugin does the same job.

• Placeholder text left in: The page still shows template filler text, such as dummy Latin copy or a leftover to-do marker. Check: Placeholder text.

• No sitemap: Search engines are given no list of the site's pages to crawl. Check: Sitemap.

  WordPress serves a basic sitemap at /wp-sitemap.xml and lists it in the robots.txt it generates; SEO plugins replace it with their own. If you upload a physical robots.txt, add the Sitemap line yourself.

• No Open Graph image: Links shared in chat apps and social media show no proper preview. Check: Open Graph.

• Broken images and files: Some images, scripts or style files on the page fail to load, so parts of the page may look broken. Check: Broken files.

• No JSON-LD structured data: Search engines get no structured details about the page or business. Check: Structured data.

• Page sent without compression: The page is sent uncompressed, so it loads slower than it needs to. Check: Compression.

  # WordPress does not compress pages itself; the web server does.
  # Managed hosts usually turn it on: ask yours to enable gzip or brotli.
  # On Apache, add to .htaccess (needs mod_deflate):
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml

• Missing HSTS header: Browsers are not told to always use the secure connection. Check: HSTS.

  <?php
  // functions.php of a child theme, or a code-snippets plugin.
  // The free "HTTP Headers" plugin sets the same header without code.
  add_action('send_headers', function () {
      header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
  });
  // WP Engine: use Web Rules > Header Rules in the User Portal instead.

• Server header exposes the stack: The server announces which software it runs. Check: Server fingerprint.

  <?php
  // functions.php of a child theme: drop PHP's X-Powered-By header.
  add_action('send_headers', function () {
      header_remove('X-Powered-By');
  });
  // The Server header comes from the web server; ask your host to hide it.