A WordPress launch is a controlled production change, not the moment to discover that backups are untested, email uses the wrong domain, or search engines can see a staging copy. This checklist covers the hosting layer, application, security, SEO, and rollback.
Confirm Ownership and Access
Record the domain registrar, DNS provider, hosting account, server panel, WordPress administrators, CDN, transactional email service, and monitoring owner. Require MFA wherever available. Remove developers and temporary accounts that no longer need access. Store recovery codes in an approved location.
Prepare DNS Without Guesswork
Export the current zone and lower TTL well before migration if a short cutover is required. Confirm A, AAAA, CNAME, MX, SPF, DKIM, and DMARC records. Do not overwrite working mail records while changing the website. Check whether both apex and www have an intentional canonical destination.
Validate HTTPS and Redirects
Install a certificate covering every public hostname and test renewal. Choose one canonical scheme and hostname, then apply a single redirect path. Avoid chains such as HTTP to HTTPS to www and then another path. Verify mixed content, security headers appropriate to the site, and the WordPress Address and Site Address.
Review WordPress Production Settings
- Use a supported PHP version compatible with the theme and plugins.
- Disable debug display in production while retaining protected error logging.
- Remove unused plugins, themes, sample content, and temporary admin tools.
- Confirm permalinks and test representative old URLs.
- Ensure the production site is not set to discourage search engines.
- Replace staging URLs in content with a serialization-safe tool.
Test Caching and Performance
Configure page caching only after dynamic pages are identified. Exclude carts, checkouts, accounts, previews, and personalized endpoints. Optimize images, preload only critical resources, and avoid enabling every CSS or JavaScript optimization simultaneously. Use the baseline in our LiteSpeed Cache setup guide where applicable.
Secure the Application and Host
Update WordPress core, themes, and plugins after a staging test. Use unique administrators, MFA, least privilege, a web application firewall, and rate limits. Review XML-RPC requirements rather than blocking it blindly; our XML-RPC security guide explains narrow controls. Confirm file permissions and prevent direct access to backups and configuration exports.
Prove Backups and Rollback
Create a complete database and file backup immediately before cutover. Store a copy outside the hosting account. Restore it to an isolated location and open representative pages. Define the rollback trigger, person responsible, DNS action, and maximum decision time. A backup that has never been restored is only a hope.
Test User Journeys and Integrations
Check desktop and mobile navigation, forms, search, login, password reset, comments, payments where used, file downloads, analytics consent, transactional email, and error pages. Submit real test forms and verify delivery plus reply routing. Test from a signed-out browser so administrator cookies do not hide caching or permission problems.
SEO and Monitoring Checks
Verify titles, meta descriptions, canonical tags, robots directives, XML sitemap, structured data, and social previews on representative templates. Register monitoring for uptime, certificate expiry, backups, and security alerts. Record a performance baseline and server resource use so post-launch changes can be compared.
Frequently Asked Questions
Should I launch immediately after a DNS change?
Only after the new origin is ready and the old site or rollback remains available during propagation. Monitor both.
Can a backup plugin replace a hosting backup?
Use independent layers. A plugin backup stored in the same compromised account may be unavailable when needed.
When should caching be enabled?
Configure and test it before launch, then purge at cutover. Exclude dynamic and personalized routes deliberately.
Launch Decision
Proceed when access, DNS, HTTPS, content, transactions, backups, SEO, performance, and monitoring have named owners and passing evidence. If rollback is unclear, the site is not ready.
