Your First Website Checklist (Before You Hit Publish)

A website launch checklist is only useful if it is honest about which items are genuinely required and which are advice. This one is tool-neutral — every item below applies whether you built on a hosted builder, on WordPress, or by hand — and it says plainly when something depends on where your visitors are.

Work through it in order. Most of it is twenty minutes. Two items take an afternoon and both are worth it.

1. The pages every site needs

1. A home page that says what this is within the first screen, without scrolling.
2. An about page. People check whether a real person or organisation is behind a site far more often than they admit.
3. A contact page with a method that works and that somebody watches. An unmonitored form is worse than no form, because it looks like a promise.
4. One page per genuine offering. Not per aspiration — per thing you can actually deliver next week.
5. A real 404 page that links back into the site rather than dead-ending.

2. The legal minimum

This section is information, not legal advice, and the specifics depend on where you and your visitors are.

1. Publish a privacy policy. In practice any site that collects personal data needs one, and analytics counts as collecting personal data. Say what you collect, why you collect it, and how someone contacts you about it.
2. Work out whether you need consent before scripts run. The obligation comes from the ePrivacy Directive (2002/58/EC, amended in 2009 and still in force in 2026): storing or accessing information on someone's device requires prior consent unless it is strictly necessary for a service they explicitly asked for.
3. Know what is exempt. Strictly necessary means login sessions, a shopping cart, a language preference. Analytics is not exempt — GA4 requires consent, and so do advertising pixels and session-replay tools. Non-essential scripts must not execute before consent is given.
4. Check the mechanics of your banner. Pre-ticked boxes are invalid. Consent has to be freely given, specific, informed and unambiguous, through a clear affirmative action. A banner that only offers Accept is not consent.

Scope note: this bites if you have visitors in the EU or UK, which almost every public site does within a month of launching.

3. Measurement, set up before launch

1. Install analytics before you announce anything, so you have a baseline to compare against. A cookieless, consent-free analytics tool is worth knowing about as a category: it sidesteps the banner requirement entirely, which is a real simplification for a small site.
2. Verify the site in Google Search Console. The documented methods are HTML file upload, an HTML meta tag, Google Analytics, Google Tag Manager, and a DNS record.
3. Choose the Domain property rather than the URL-prefix one. A Domain property can only be verified by DNS record, and it covers every protocol and every subdomain. A URL-prefix property cannot use DNS verification and covers only that exact protocol and path. The Domain property is slightly more work once and much less confusion forever.

4. What your link looks like when it is shared

1. Add a favicon. It is what people recognise in a wall of browser tabs and in their bookmarks.
2. Add an Open Graph image, plus og:title and og:description. These control what appears when somebody pastes your link into a message or a post. Without them, platforms pick something arbitrary — often a fragment of a logo, sometimes nothing at all.
3. Paste your own URL into a chat app and look at the preview before anyone else does.

5. Mobile and speed

1. Open the site on an actual phone, not a narrowed browser window. Check that tap targets are big enough for a thumb and that nothing scrolls sideways.
2. Run a page-speed check against the Core Web Vitals thresholds: Largest Contentful Paint at or under 2.5 seconds, Interaction to Next Paint at or under 200 milliseconds, Cumulative Layout Shift at or under 0.1. They are assessed at the 75th percentile of page loads, segmented into mobile and desktop.
3. Fix the images before anything else. On a first site the highest-leverage improvement is almost always image size, not code. A single unresized photograph straight off a phone can be the entire problem.

6. Backups

1. Answer one question in writing: if this breaks tomorrow, what restores it? Hosted builders back up automatically. Self-hosted WordPress does not unless somebody configured it. A hand-coded site kept in version control is backed up by definition.
2. Test the restore once, now, while the site does not matter yet. An untested backup is a belief, not a backup.

7. Accessibility basics

1. Alt text on every meaningful image, and an empty alt attribute on purely decorative ones so screen readers skip them.
2. Enough colour contrast between text and background, checked rather than guessed.
3. A logical heading order: one h1 per page and no skipped levels.
4. Keyboard navigation that works, with a visible focus state you have not styled away.
5. Labelled form fields, a lang attribute on the html element, and pinch-zoom left enabled. Never disable zooming.

On the law: the European Accessibility Act has applied since 28 June 2025 and references EN 301 549, which points at WCAG 2.1 Level AA. Microenterprises — fewer than ten employees and under €2 million annual turnover — are generally exempt, and that exemption covers services rather than products.

One claim we could not stand behind: it is widely reported that WCAG 2.2 has not yet been folded into the harmonised standard. We found that in vendor summaries rather than in the standards record itself, so treat it as unconfirmed and check the current position before relying on it.

Where this sits in the course

This is the last gate before publishing, and it is deliberately identical on every route. If you are working backwards from here and have not chosen a route yet, start with the full guide to how to make a website and come back to this page on launch day.

The five-minute version

• Home, about, contact and a 404 all exist, and contact is monitored.
• A privacy policy is published, and nothing non-essential runs before consent.
• Analytics is installed and a Domain property is verified in Search Console.
• The favicon is set and your link previews correctly when pasted.
• You have used the site on a real phone and resized the images.
• You have restored a backup once, and headings, alt text and zoom all behave.