Most launch checklists are written for agencies handing over a client site, with fifty items about browsers and image formats. This one is for a founder who built an app and is about to share the link. It’s in the order you should check things, and every item links to a way to check it for free.
Domain and the basics
- Your own domain, not the builder’s address.
bloomly.example, notbloomly.lovable.app. - Every other address redirects to it, including
wwwand the builder’s address, so the same page doesn’t live at two addresses. - HTTPS works and
http://redirects tohttps://. - A clear headline. A stranger understands in five seconds what it is and who it’s for. See why visitors leave without signing up.
- A 404 page that links back home, instead of a blank screen.
- It works on a phone. Open every public page on your own phone, and check speed with Google’s PageSpeed Insights.
What Google sees
- Readable pages. Your text is in the page source, not added later by JavaScript. Check with View Page Source.
- No leftover block. No
noindextag on public pages and noDisallow: /in robots.txt. The meta tag checker shows both. - A unique title and description on every public page, under about 60 and 160 characters.
- A sitemap that lists only your public pages, with full addresses on your domain. Check it with the sitemap validator.
- Google Search Console set up and your sitemap submitted. Then Bing Webmaster Tools, which you can import from Search Console.
- AI crawlers allowed, if you want to show up in ChatGPT, Claude or Perplexity answers. The AI visibility checker shows which ones your robots.txt lets in.
If Google can’t find you after a couple of weeks, read why your website isn’t showing up on Google.
How your link looks when shared
- A link preview with a title, a sentence and an image, 1200 × 630 pixels works well. Check it with the Open Graph preview.
- A Twitter card for X. Check with the Twitter card validator.
- Your own favicon, not the builder’s logo. Check with the favicon checker.
Safety and emails
- Strangers can’t read your data. Sign in as two test users and make sure neither sees the other’s records. On Supabase, Row Level Security is on for every table. See vibe coding security: 5 things to check.
- No secret keys in the browser. Search your page’s source for words like
secretandservice_role. - Admin pages refuse ordinary users, including when you type the address directly.
- Sign-up emails arrive in the inbox, from your own domain, with SPF, DKIM and DMARC set up. Check SPF with the SPF checker and read why sign-up emails go to spam.
Measuring and legal
- Analytics that counts visitors, where they came from and sign-ups.
- A privacy policy and terms that describe what your app actually collects. If you serve people in the EU, check whether you need a cookie banner. Cookieless analytics often doesn’t.
- A way to contact you, an email address or a feedback button.
Launch day and the first week
- Two or three places picked where your users already talk. See how to get your first users.
- Tagged links for each place, like
bloomly.example/?utm_source=reddit, so you know what worked. - Time blocked to reply to every comment and message on launch day.
- A plan for week two. One launch rarely does it. See the product launch strategy for first-time founders.
Website launch checklist for AI-built apps
Each builder handles part of this list for you. Lovable and Base44 serve search engines readable pages, and Base44 creates your sitemap. Others leave more to you. Our launch checklists for AI-built apps show what your builder does and what’s left, for Lovable, Base44, Bolt, Replit, v0, Cursor and Claude Code.