The site is live. You posted the link. A few friends said it looks great. You closed the laptop feeling like you finished something.
Then a week goes by, and small questions start to creep in. Is anyone actually visiting? Did that form ever send anything? Why does the link look blank when someone shares it? When does the domain renew, and whose card is on it?
Nobody hands you a list for this part. Builders get you to launch. Hosts keep the lights on. The in-between, the dozens of small things that make a site trustworthy and findable, is left to you.
What’s actually going on
A live site is a set of connected parts. Your domain points to your host. Your host serves your pages over a secure connection. Search engines read those pages. Your forms send email through a provider. Analytics watches traffic. Payments and logins, if you have them, depend on keys and settings in other services.
Each part can be slightly wrong without anything looking broken. That is why launch-day checks miss things. The page loads, so it feels done. The problems show up later, quietly, as missed leads and confused customers.
Most post-launch problems aren’t dramatic. They are small, silent gaps that cost you leads until someone notices.
The checklist
Work through it in order. Each item has one line on why it matters.
Domain and security
- Your site loads on your own domain, with and without “www.” Visitors type it both ways, and one version shouldn’t be a dead end.
- HTTPS works with no browser warnings. Modern hosts usually set up SSL automatically once DNS is right, but DNS changes can take time to propagate, so check again after a day.
- Domain auto-renew is on, with a current card. An expired domain takes your site and email down at the same time.
- Two-factor authentication is on for your registrar, host, builder and email. Those logins control everything, and a password alone is easy to lose.
Search and sharing
- Every important page has its own title and description. Single-page apps from tools like Bolt and Lovable often ship one generic set for every route and may need per-route meta or prerendering.
- Your site is in Google Search Console with a sitemap submitted. It helps Google find and index your pages, though it doesn’t guarantee indexing.
- You aren’t accidentally blocking search engines. A leftover “noindex” setting or restrictive robots file from building can hide your whole site.
- Basic structured data describes your business. It helps search engines understand who you are, even though it doesn’t guarantee any special result.
- Link previews show the right title and image. Set Open Graph tags with a 1200x630 image so shared links look intentional, not blank.
Measurement
- Google Analytics 4 is installed and recording visits. Without it you are guessing about what works.
- Key actions are tracked as conversions. Form submissions and phone clicks are what actually matter to your business, not just page views.
Leads and email
- Every form sends to an inbox someone checks, and you’ve tested it this week. Forms break silently when settings, keys or email providers change.
- Your sending domain has SPF, DKIM and DMARC records. Without them, your form notifications and replies are more likely to land in spam.
Payments and accounts
- Payments run in live mode, not test mode, and secret keys stay off the frontend. Your Stripe secret key belongs on a server, and prices should be set server-side, not trusted from the browser.
- If you have logins, each user can only see their own data. In Supabase that means Row Level Security policies on every table, plus testing as a second user.
Quality
- Pages load quickly on a phone. Most visitors will see your site on mobile first, and slow pages lose them.
- The basics of accessibility are covered. Readable contrast, image alt text, labeled form fields and keyboard navigation help every visitor, not just some.
- No broken links or missing pages. A dead link on your services page looks like a closed business.
Protection
- Privacy policy and terms pages exist and match what your site actually does. If you collect emails, run analytics or take payments, you likely need them, and a lawyer should review the wording.
- You have a recent backup, or know how to restore a previous version. Builders and hosts differ here, so find out before you need it.
What to do right now
Don’t try to do all twenty tonight. Pick a path.
- Start with the five that cause the worst surprises: domain auto-renew, two-factor, a form test, Search Console and a backup.
- Block an hour this week for search and sharing items. Titles, descriptions and preview images are worth doing together.
- Set a monthly reminder to retest forms, check for broken links and confirm your domain and SSL are healthy.
- Write down where everything lives. Registrar, host, builder, email, analytics, Stripe, Supabase. One page with logins stored in a password manager saves hours later.
When to hand it off
Some of this list is a one-time setup. A lot of it is ongoing: forms break, renewals sneak up, new pages need titles, and a builder update can undo something you fixed last month. That ongoing part is exactly what a care plan is for.
Every AftUp plan includes uptime and SSL monitoring, GA4 setup, SEO basics, a monthly form test and a plain-English monthly report. Growth adds weekly form and broken-link checks, conversion tracking, speed tuning and up to two hours of fixes each month. You can see how it works on the how it works page, browse everything we cover on what we handle, and compare plans on the pricing page. If you are still at the “I just built this” stage, built it in a weekend is a good companion read.
If you want to know which of these twenty your site is missing, send us your URL for a free site check and you will have a report within 48 hours.