Pre-launch checklist (short version)

The 25 checks I’d never skip before letting strangers pay. Print it and tick it off. Not legal or tax advice.

Accounts and email

• Signup, sign-in and sign-out work, and a signed-out visitor can’t reach paid pages
• Password reset works and doesn’t reveal whether an email address has an account
• Transactional email arrives in Gmail, Outlook and a work inbox, not in spam
• SPF, DKIM and DMARC are set for your sending service
• Inbound mail works: send a test to your contact address

Money

• Hosted checkout and the billing portal are used. You built no payment forms
• Every billing scenario passes in Stripe test mode
• Then once with a real card on the live site: buy, change plan, cancel, refund
• The webhook signing secret is set for the live endpoint
• You know your sales-tax position before the first sale

Legal pages

• Terms, privacy policy and refund policy, matching what you actually do
• A way to reach a person

Hosting and deploys

• Production runs only production. Development happens elsewhere, or in a worktree
• Builds happen out of place and are swapped in only after every check passes
• Rollback is one command, and you’ve actually used it once
• Secrets live in env files that are not in git, and in your password manager

Data and backups

• A database backup you control, not just the provider’s
• You have restored a backup once, for real
• Row-level security (or your equivalent) is on for every table that holds user data

Monitoring

• An uptime check from outside your network, alerting your phone
• A check for each thing that would break silently: inbound email, backups, scheduled jobs

Launch day

• Make one real purchase yourself, then refund it, and confirm both emails arrived
• Sign up as a brand-new user in a private window and do the main thing
• Check the site from your phone on mobile data
• Check the mail (MX) records one more time