Before you share the link.

Twenty-one checks for a website or web app, in the order we run them before a link goes out. Tick each one off as you go.

0of 21 done

Your ticks stay in this browser, on this device. Nothing is sent anywhere.

01/It opens properly0/5

Open it on your phone, on mobile data.
Most first visits come from a link tapped on a phone. Wi-Fi and a laptop hide slow images and layouts that break on a narrow screen.
Open it in a private window.
No saved logins, no cache. You see what a stranger sees.
Paste the link into a chat and look at the preview.
The title, description and image are the first thing anyone sees. Set og:title, og:description and a 1200 by 630 og:image on every page you'll share.
metatags.io ↗
Give it a favicon and a home-screen icon.
Tabs, bookmarks and phone home screens show it. Without one, a blank page stands in.
Visit a page that doesn't exist.
Your 404 page should lead back to the site, not to a dead end.

Run PageSpeed Insights on your main page.
It loads the page on a simulated phone, times how long the main content takes to appear, and names what slows it down.
pagespeed.web.dev ↗
Shrink your biggest images.
The hero image is usually the heaviest thing on the page. Export it at the size it's shown, as WebP or AVIF.
squoosh.app ↗

Give every page its own title and description.
They're what a search result shows. One title shared by every page tells a search engine nothing.
Remove any noindex left over from staging.
A noindex tag, or a robots.txt that blocks everything, keeps the whole site out of search without a single error. Open /robots.txt and the page source to check.
Submit your sitemap to Google Search Console.
It tells Google which pages exist, and shows you when one can't be indexed and why.
search.google.com/search-console ↗

Run an accessibility check.
Missing alt text, low contrast and form fields without labels take a minute to find, and shut people out until they're fixed.
wave.webaim.org ↗
Use it with only the keyboard.
Tab through every page. If you can't see where you are, or can't reach a button, neither can someone who doesn't use a mouse.

Send every form yourself, from your phone.
Fill it in, submit it, and watch the result arrive where it should. A form that fails quietly looks like nobody's interested.
Make sure your email lands in the inbox.
Set SPF, DKIM and DMARC for your domain, or sign-up and password emails go to spam. Your email provider's dashboard shows which are missing.

Switch every payment key to live.
Test keys take test cards and nothing else. Check every place one is set: the server, the app and the webhooks.
Make one real purchase, then refund it.
It's the only way to see the whole path: the charge, the receipt, the webhook, and what your app does next.

Turn on error tracking.
The errors your users hit are errors you never see. A service such as Sentry sends each one to you with the page it happened on.
Add a check that tells you when it's down.
An uptime monitor, or a scheduled check of everything your site depends on, should email you before a user does.

Publish a privacy policy that says what you collect.
UK and EU data protection law asks for one as soon as you collect personal data, even an email address. A careful customer opens it first.
Make one address win.
Serve it over https, with www and the bare domain redirecting to the same one, so links and search results don't split between two.
Give people a way to reach you.
A contact form or an email address that someone actually reads.