Before your shop takes its first order.

The first thing customers touch and the first thing that breaks quietly during a DNS switch.

• The domain is registered to the company, not to a developer or agencyBlockers

  Registrant, admin and billing contacts belong to the business. Auto-renew is on, the payment card is valid, the registrar account has 2FA and a transfer lock.

• DNS TTLs lowered 24–48 hours before the switchHigh

  Set A, AAAA and CNAME records to 300 seconds so a rollback propagates in minutes. Raise them again once the launch is stable.

• Every host variant ends on one canonical URLBlockers

  http://, https://, with and without www all reach the same address in a single 301 redirect, with no chains.

• CAA record limits who can issue certificatesRecommended

  For example 0 issue "letsencrypt.org". Include the certificate authority your CDN or host uses, or automatic renewal will fail.

• SPF covers every service that sends mail as your domainBlockers

  Shop platform, transactional mail provider, newsletter tool, helpdesk, Google Workspace or Microsoft 365. One SPF record only, under 10 DNS lookups.

• DKIM signing enabled for each sending serviceBlockers

  Publish every provider's DKIM key and send a test message. The headers should show dkim=pass, aligned with the From domain.

• DMARC published and monitoredBlockers

  Start with p=none and an rua= report address, then move to quarantine or reject once the reports are clean. Gmail, Yahoo and Outlook require DMARC from bulk senders.

• Marketing mail supports one-click unsubscribeHigh

  List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058). Opt-outs are honoured within two days and the spam complaint rate stays below 0.3%.

• Transactional and marketing mail are separatedHigh

  Use a separate subdomain or stream, for example mail. and news., so one poor campaign cannot push order confirmations into spam.

• Reply addresses exist and someone reads themHigh

  orders@, support@, returns@, privacy@. Never use noreply@ on anything a customer might answer.

• MX records verified after the DNS moveBlockers

  Send a message to every public address from an external account right after the switch.

Production must behave like the environment you tested, and a bad release must be reversible in minutes.

• Production runs production configurationBlockers

  Check the base URL, asset and CDN URLs, API endpoints, mail provider, payment keys, search index and feature flags. Search the built site for staging, localhost and test hostnames.

• Debug mode is off and errors stay privateBlockers

  No stack traces, SQL errors or framework debug pages. Custom 404 and 500 pages keep the header, search and a way back to shopping.

• TLS certificate valid and renewing automaticallyBlockers

  Covers the apex, www and any subdomain in use. TLS 1.2 or newer only, grade A on SSL Labs. Set an expiry alert that does not depend on the renewal job.

• HTTPS everywhere, no mixed contentBlockers

  Images, scripts, fonts and iframes load over HTTPS. Check the console on the home, category, product, cart, checkout and account pages.

• Staging is private and not indexableHigh

  Protect staging with HTTP auth or an IP allowlist and send X-Robots-Tag: noindex. Staging must never send real emails or charge real cards.

• Deployment is repeatable and rollback has been rehearsedBlockers

  One pipeline or command deploys; the previous release can be restored in minutes. Database migrations are backwards compatible or have a tested way back.

• Scheduled jobs run in productionBlockers

  Order export, stock sync, abandoned cart mail, sitemap and feed generation, currency rates, cache warm-up, expired cart cleanup. Confirm each one ran once after launch.

• Queue workers run under supervisionHigh

  Emails, webhooks, invoices and search indexing. A supervisor restarts crashed workers and an alert fires when the queue keeps growing.

• Page cache never serves personal dataBlockers

  Cart, checkout, account and order pages, and any response that sets a session cookie, bypass the cache. Test it: add to cart in browser A, open the same URL in browser B, and B's cart must be empty.

• Server and store time zones are setHigh

  They drive order timestamps, sale start and end times, invoice dates and same-day dispatch cut-offs.

• Load tested at a realistic peakHigh

  Simulate browsing, add-to-cart and checkout at three to five times the expected launch traffic with k6 or Locust. Watch database connections, workers and third-party API limits.

• Resource limits reviewedHigh

  Disk space for logs, uploads and backups, database storage, bandwidth, CDN plan limits and serverless function timeouts.

• Maintenance page readyRecommended

  It returns HTTP 503 with Retry-After so search engines do not index it, and admins can bypass it.

Shops are attacked for card data, gift card balances, customer data and cheap card testing. Most attacks are automated and start within hours of launch.

• Admin accounts use 2FA and default accounts are goneBlockers

  No default logins, no shared accounts, no former contractors. Staff get the narrowest role that works; warehouse staff cannot issue refunds.

• Admin panel protected beyond a passwordHigh

  Restrict it by IP or VPN where the platform allows, rate-limit logins and lock out repeated failures.

• Secrets are not reachable from the webBlockers

  .env, .git/, database dumps, archives and phpinfo.php return 403 or 404. Rotate any key that was ever committed to a repository.

• Security headers setHigh

  Strict-Transport-Security, Content-Security-Policy (report-only first), X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy and frame-ancestors against clickjacking.

• Prices, totals and discounts are calculated on the serverBlockers

  Tamper with the price, quantity (negative, zero, 99999, decimals), product ID and shipping method in the request. The server must reject or recalculate.

• Coupon and gift card abuse is closed offBlockers

  Test stacking codes, reuse beyond the limit, codes applied after a partial refund, and guessable codes. Rate-limit coupon and balance endpoints.

• Card testing protection on checkoutBlockers

  Fraudsters use new shops to test stolen cards with tiny orders. Turn on the provider's fraud tools, velocity rules per IP, email and card, and a bot challenge after failed attempts.

• Orders, invoices and addresses cannot be read by changing an IDBlockers

  Change the number in /account/orders/1234 or an invoice link: another customer's data must never appear. Guest order links use unguessable tokens.

• Last-item race conditions handledHigh

  Two customers buying the last unit at the same moment must not both succeed, unless you have a written process for overselling.

• Forms protected against spam and injectionHigh

  Contact, review, newsletter and registration forms: server-side validation, CSRF tokens, a honeypot or invisible challenge, and escaped output against XSS in reviews and names.

• Customer uploads are restrictedHigh

  For personalisation or return photos: file type allowlist, size limit, storage outside the web root, and no execution.

• Platform, theme, plugins and dependencies up to dateBlockers

  Remove unused plugins and themes. Run npm audit, composer audit or the platform's scanner and subscribe to security advisories for everything you run.

• WAF and bot protection enabledHigh

  Managed WAF rules at the CDN or host, bot management against scraping and credential stuffing, and DDoS protection.

• Third-party scripts reviewedHigh

  Every tag, from chat to reviews to A/B testing, can read the page. Remove what you do not need and pin versions or use SRI where possible.

The most common launch-day failure: the shop is live, but it still uses test keys or its webhooks point at staging, so orders never get marked as paid.

• Payment provider account fully activatedBlockers

  Business verification complete, company and bank details confirmed, payouts enabled and the account is not restricted. You know the payout schedule and currency.

• Live API keys in production, test keys removedBlockers

  Both publishable and secret keys are live. No test keys remain in config, environment variables or the frontend bundle.

• Webhooks registered in live mode and pointing at productionBlockers

  Live mode has its own endpoints and signing secrets. Signature checks pass with the live secret, and the handler is idempotent: the same event twice updates the order once.

• Order status follows the confirmed payment, not the redirectBlockers

  A customer who closes the tab after paying still gets a paid order through the webhook. A crafted return URL must never mark an order as paid.

• A real purchase and a full refund completed in productionBlockers

  Pay with your own card. Check the order status, stock level, confirmation email, invoice, the charge on your statement, the refund and the refund email. Test a partial refund too.

• Strong Customer Authentication (3-D Secure 2) worksBlockersEU

  Cards issued in the EEA require SCA under PSD2. Test the challenge on a phone, including the jump to the banking app and back to the browser.

• Declines and errors explain what to doHigh

  Insufficient funds, expired card, failed 3-D Secure, cancelled redirect: the customer returns to checkout with the cart intact and a clear message.

• Local payment methods enabled for each marketHighEU

  Poland: BLIK, fast bank transfers (Przelewy24, PayU), cards, Apple Pay and Google Pay. Netherlands: iDEAL. Belgium: Bancontact. Germany: PayPal, Klarna, SEPA. Buyers leave when their usual method is missing.

• Delayed payment confirmations handledBlockers

  Bank transfers, BLIK timeouts, SEPA debits and pay-later methods can confirm minutes or days later. Orders stay pending, stock is reserved for a set time and unpaid orders expire automatically.

• Apple Pay domain verified and Google Pay approvedHigh

  Upload the domain association file for the production domain (and www). Google Pay production access is approved.

• Card statement descriptor is recognisableHigh

  Customers see the shop name they know, plus a support phone number or URL where supported. Unclear descriptors lead to chargebacks.

• Currency, rounding and minimum amounts correctHigh

  Totals match to the cent across cart, payment gateway, invoice and accounting. Check the provider's minimum charge and zero-decimal currencies if you sell in HUF or JPY.

• PCI DSS scope confirmed, usually SAQ ABlockers

  Use hosted fields, a hosted payment page or a redirect so card data never touches your servers. Complete the self-assessment your provider requires every year.

• Payment page script inventory and change monitoringBlockers

  PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1, mandatory since 31 March 2025, target card skimming. List and approve every script on pages that host the payment form, and check for unauthorised changes at least weekly.

• Chargeback and dispute process definedHigh

  Who responds, where the evidence lives (tracking, proof of delivery, IP address, emails) and the deadlines. Dispute notices go to a monitored inbox.

Every point of friction here costs orders. Test it as a first-time customer, on a phone.

• Guest checkout availableHigh

  Forced registration is one of the top reasons for abandoned carts. Offer account creation after the order instead.

• The full price is visible before the final stepBlockers

  Item prices, delivery, duties and taxes appear before the customer commits. No surprise fees on the last screen. Card surcharges for consumers are banned in the EU.

• The final button states the obligation to payBlockersEU

  EU law requires wording such as “Order with obligation to pay” or an unambiguous equivalent. “Continue” or “Next” is not enough, and the consumer may not be bound by the order.

• No pre-ticked boxes for extras or consentsBlockersEU

  Insurance, gift wrap, newsletter and terms acceptance all start unticked.

• Delivery restrictions shown earlyHighEU

  Countries you do not ship to and the accepted payment methods are clear at the start of the ordering process, not after the address is entered.

• Address form fits the target countriesHigh

  Postal code formats (Poland: 00-000), an optional second address line, company name and VAT number for business buyers, a phone number with country code for couriers, and parcel locker selection (InPost, DPD Pickup) where it matters.

• Browser autofill worksHigh

  Correct autocomplete attributes (given-name, postal-code, email, tel) and inputmode for numeric fields.

• Validation messages are specific and inlineHigh

  Errors say what is wrong and how to fix it, appear next to the field and never wipe what the customer typed.

• Double submission preventedBlockers

  A double click on the pay button or a refresh of the confirmation page must not create two orders or two charges. Use an idempotency key per checkout.

• The cart survives login, session expiry and device changesHigh

  Guest and account carts merge on login, guest carts persist for a reasonable time, and the back button from the payment page returns to a working checkout.

• Items that sell out during checkout are handledHigh

  If a product sells out between the cart and the payment, the customer learns about it before paying, not after.

• Shipping rates tested for every zone and weight bandBlockers

  Free shipping threshold, heavy and oversized items, remote areas, mixed carts and local pickup. Compare the rates with what the carrier will actually invoice.

• Discount rules produce correct totalsHigh

  Percentage and fixed amounts, free shipping codes, minimum spend, excluded and already reduced products, automatic discounts and rounding with VAT.

• The confirmation page shows the order number and next stepsHigh

  What happens next, the expected delivery date and how to reach support. The purchase tracking event fires here exactly once.

• Checkout works inside in-app browsersHigh

  Instagram, Facebook and TikTok browsers often break payment redirects and 3-D Secure. Test the whole path from an ad or a bio link.

Wrong prices and missing product information are a revenue problem everywhere and a legal one in the EU.

• Every price checked against the price listBlockers

  Export the catalogue and review it in a spreadsheet: zero prices, missing decimals, net versus gross, sale and variant prices. Sort by price to catch outliers.

• Consumer prices include VATBlockersEU

  Prices for consumers are shown gross. Show the unit price per kilogram or litre where the law requires it for goods sold by weight or volume.

• Price reductions show the lowest price from the previous 30 daysBlockersEU

  Under the Omnibus Directive, any announced discount must show the lowest price from the 30 days before the reduction. Launch-week “sales” with no price history are a known enforcement target.

• Stock levels accurate and synchronisedBlockers

  Opening quantities match a physical count. Sync with the ERP, warehouse and marketplaces is tested in both directions. Backorders are an explicit decision per product.

• Product safety information shown (GPSR)BlockersEU

  Since 13 December 2024 every listing must show the manufacturer's name, postal and electronic address, an EU responsible person when the manufacturer is outside the EU, a product identifier, and warnings or safety information in the local language.

• Category-specific labels presentHighEU

  Energy labels and product information sheets for appliances, textile fibre composition, allergens and nutrition for food, age warnings for toys, and ingredient lists for cosmetics.

• No placeholder or test content leftBlockers

  Search the database and templates for lorem, test, asdf and TODO, dummy products and demo categories. Delete test products rather than hiding them.

• Images licensed, optimised and consistentHigh

  You own or have permission for every photo; supplier images often need consent. Aspect ratios match within a category, zoom works and alt text is written.

• Variants work end to endBlockers

  Choosing a size or colour updates the price, image, stock status and SKU. Unavailable variants are clearly marked and the right variant reaches the order.

• Delivery times shown per productHigh

  Realistic dispatch and delivery estimates, with a separate note for made-to-order and pre-order items.

• Reviews are genuine and the verification policy is disclosedHighEU

  If you show reviews, state whether and how you check that they come from buyers. Never import or write fake reviews; the EU lists this as an unfair practice.

• Ranking and personalised pricing disclosedRecommendedEU

  If paid placement influences search or sorting, or prices are personalised by an algorithm, explain the main parameters.

• Site search returns sensible resultsHigh

  Typos, plurals, SKUs and Polish diacritics (zolty finds żółty). The zero-results page suggests alternatives.

The order you accept has to leave the warehouse when you promised.

• Carrier accounts live and labels printBlockers

  Production API credentials for each carrier, a tested label printer, the correct sender address and a scheduled pickup or known drop-off point.

• Orders reach fulfilment correctlyBlockers

  The warehouse, 3PL or dropshipping supplier receives the right items, variants, address, phone number, parcel locker ID and delivery method.

• Tracking numbers flow back to the order and the customerHigh

  The shipping email includes a working tracking link.

• Packaging and inserts readyHigh

  Boxes in the sizes you need, filler, invoice or packing slip, and return instructions or a return label.

• Every order status has an ownerHigh

  New, paid, awaiting payment, processing, shipped, delivered, cancelled, refunded, returned. Each status has a person responsible and a response time.

• The returns flow tested end to endBlockers

  Request, label, receipt, inspection, restocking, refund, corrective invoice and customer notification.

• Cut-off times and holiday calendar setRecommended

  Same-day dispatch cut-off, weekends, public holidays and carrier peak periods are communicated on the site.

The required pages must exist before the first sale. EU consumer rules changed several times between 2024 and 2026.

• Company identification is visibleBlockersEU

  Legal name, registered address, registration number (in Poland: KRS or CEIDG, NIP, REGON), share capital for limited companies, email and phone, linked from the footer on every page.

• Terms and conditions (regulamin) publishedBlockersPL

  Ordering, payment, delivery, withdrawal, complaints, liability and governing law. In Poland the regulamin is mandatory for electronic services and must be available before the contract is concluded, in a form the customer can save.

• The 14-day right of withdrawal explained, with a model formBlockersEU

  How to withdraw, who pays for the return, a refund within 14 days of the withdrawal (it may be held until the goods come back), and the exceptions: personalised goods, perishables, unsealed hygiene products, and digital content supplied with consent.

• Online withdrawal button in placeBlockersEU

  Directive 2023/2673 applies from 19 June 2026: a clearly labelled function such as “Withdraw from contract here”, available throughout the withdrawal period. The customer gives their name and order details, confirms, and receives an automatic acknowledgement by email. It must not be harder than placing the order. Check how your country has implemented it.

• Legal guarantee and complaints process describedBlockersEU

  Two years of liability for goods that do not conform to the contract, a complaints procedure with a response deadline (14 days in Poland, after which the complaint is treated as accepted), and any commercial warranty kept separate from statutory rights.

• The ODR platform link is removedHighEU

  The EU Online Dispute Resolution platform closed on 20 July 2025. Remove the link from the footer, terms and emails. Keep information about national out-of-court dispute bodies where your country requires it.

• Shipping and returns page publishedBlockers

  Carriers, costs, zones, dispatch times, lost or damaged parcels, the return address, and how and when refunds are paid.

• Contract confirmation sent on a durable mediumBlockersEU

  After the order, send its details together with the terms and withdrawal information, for example as a PDF or in the email body. A link to a page that may change does not count.

• Accessibility statement publishedHighEU

  Required under the European Accessibility Act for in-scope e-commerce services since 28 June 2025. It states the conformance level, known gaps and how to report problems. Micro-enterprises providing services (fewer than 10 staff and up to €2 million turnover) are exempt.

• Packaging, electronics and battery obligations checkedHighPL

  In Poland: a BDO registration number and packaging reporting if you place packaged goods on the market, plus take-back information if you sell electronics or batteries. The EU Packaging Regulation (PPWR) starts to apply in August 2026, so check what it changes for your packaging.

• Age-restricted and regulated products checkedHigh

  Alcohol, tobacco and vapes, supplements, medicines and knives: check licensing and age verification rules in each country before listing.

• Trademark and name checkedRecommended

  The shop name does not infringe a registered mark in your markets (EUIPO and national registers). Register your own mark if the brand matters.

• US sales tax, privacy and accessibility exposure reviewedHighUS

  Economic nexus thresholds by state, California privacy rights including Global Privacy Control, and the risk of ADA web accessibility claims, which often target retailers.

Mistakes here surface months later as penalties. Confirm the setup with your accountant before the first order.

• VAT rates correct per product and destinationBlockers

  Reduced rates for books, food or children's goods mapped to the right products. Shipping is taxed at the rate of the goods it accompanies where the rules require it.

• EU One-Stop Shop set up for cross-border consumer salesBlockersEU

  Above €10,000 a year of intra-EU distance sales you charge the buyer's country VAT and report it through OSS. The shop must apply destination-country rates.

• Reverse charge with VIES validation for EU businessesHighEU

  EU business buyers with a valid VAT number get 0% VAT and a reverse charge note on the invoice. Validate the number in VIES at checkout and keep the result.

• KSeF e-invoicing in placeBlockersPL

  Structured e-invoices are mandatory in Poland from 1 February 2026 for the largest companies and from 1 April 2026 for most others; sellers invoicing up to PLN 10,000 a month may stay outside KSeF until the end of 2026. B2B invoices must go through KSeF; consumer invoices may be issued outside it. Test the integration and KSeF authorisation.

• Fiscal receipt obligation confirmedHighPL

  Online sales to consumers paid through a bank or payment provider are generally exempt from the cash register in Poland, but goods on the statutory exclusion list are not. Confirm your product range with your accountant.

• Invoice numbering is continuous and starts correctlyBlockers

  Test invoices from staging are deleted or voided, the production series starts at the intended number, and corrective invoices work for refunds.

• Payouts reconcile with ordersHigh

  Provider reports, fees, refunds and chargebacks can be matched to orders in accounting. The export or integration with your accounting system is tested.

• Customs data ready for non-EU shippingRecommended

  HS codes on products, commercial invoice data for carriers, IOSS for imports up to €150 into the EU, and a decision on who pays duties (DDP or DAP).

Regulators scan consent banners with automated tools. Tracking before consent is the most common violation.

• No non-essential cookies or tags before consentBlockersEU

  Open the site in a clean browser. Before anything is clicked, DevTools must show no analytics, advertising or pixel requests (Google Analytics, Meta, TikTok, Hotjar).

• Rejecting is as easy as acceptingBlockersEU

  “Reject all” on the first layer, as prominent as “Accept all”. Consent can be withdrawn later through a persistent link or icon.

• Google Consent Mode v2 implementedHighEU

  Required for ad personalisation and remarketing on EEA traffic. The default state is denied, and ad_storage, analytics_storage, ad_user_data and ad_personalization update from the banner. Verify with Tag Assistant.

• The privacy policy matches what the site actually doesBlockers

  Controller, purposes, legal bases, every processor and recipient (payments, carriers, email, analytics, hosting, support tools), transfers outside the EEA, retention periods, rights and a contact.

• Data processing agreements signedHighEU

  With hosting, payments, email tools, logistics, helpdesk and analytics. Keep a record of processing activities.

• Newsletter consent is separate and untickedBlockersEU

  A separate checkbox, never bundled with accepting the terms. Double opt-in makes consent provable. In Poland, email, SMS and phone marketing requires prior consent under the Electronic Communications Law.

• Data subject requests have a processHighEU

  Access, deletion and export requests handled within one month. Who does it, and how data is removed from the shop, email tools and other systems.

• Data breach plan readyHighEU

  Who decides, and how you notify the supervisory authority (UODO in Poland) within 72 hours and the affected customers when required.

• Data retention and clean-up scheduledRecommended

  Abandoned carts, guest data, logs and inactive accounts deleted or anonymised on schedule. Invoices kept for the statutory period (in Poland, five years from the end of the year in which the tax payment deadline passed).

Mandatory for in-scope EU shops since June 2025 under the European Accessibility Act, and better conversion for everyone.

• A full purchase is possible with the keyboard aloneBlockersEU

  Menu, filters, variant picker, quantity, cart drawer, checkout, payment form and cookie banner. Focus is visible at every step and modals do not trap it.

• Buying path tested with a screen readerHigh

  VoiceOver and NVDA announce the product name, price, variant choice, add-to-cart feedback, cart count and errors.

• Colour contrast meets AAHigh

  4.5:1 for body text and 3:1 for large text and interface components such as buttons and field borders. Sale prices and error text often fail.

• Images and icons have text alternativesHigh

  Product photos describe the product, decorative images have empty alt text, and icon-only buttons (cart, search, close) have accessible names.

• Forms have labels and announced errorsHigh

  Visible labels rather than placeholders alone, required fields marked, and errors linked with aria-describedby and announced.

• Zoom and reflow workHigh

  Usable at 200% zoom and at 320 pixels wide without horizontal scrolling. Increased text spacing does not clip content.

• Motion and time limits are controllableRecommended

  Carousels can be paused, banners do not advance without controls, and session timeouts warn and allow more time.

• Automated scan is cleanHigh

  axe DevTools or Lighthouse shows no critical issues on key templates. Automated tools catch only part of the problems, so the manual checks above still matter.

Slow product and category pages lose sales and rankings. Measure on a mid-range Android phone on 4G, not on your laptop.

• Core Web Vitals pass at the 75th percentileHigh

  LCP up to 2.5 s, INP up to 200 ms and CLS up to 0.1. Test the home, category, product and cart pages with PageSpeed Insights and WebPageTest.

• Images use modern formats and the right sizesHigh

  AVIF or WebP with srcset and sizes, width and height set to prevent layout shift, and lazy loading below the fold only. The main hero image is not lazy and has fetchpriority="high".

• CDN and caching configuredHigh

  Static assets cached long-term with hashed file names, HTML cached where safe, Brotli or gzip compression, HTTP/2 or HTTP/3.

• Third-party scripts kept within a budgetHigh

  Count the tags on product pages. Load chat, review widgets and heatmaps after interaction or when the browser is idle; each one costs responsiveness.

• Fonts optimisedRecommended

  Subset woff2 files, font-display: swap, and preload only the one or two faces used above the fold. Include Polish characters in the subset.

• Database and search respond fast under loadHigh

  Slow query log reviewed, indexes on order, customer and product lookups, and category pages with many filters tested for response time.

• Real-user monitoring enabledRecommended

  Collect field Web Vitals from real visitors so that regressions after launch become visible.

Launching with a leftover noindex is the classic mistake that stays invisible for weeks.

• Staging noindex and robots blocks removedBlockers

  robots.txt no longer contains Disallow: /, and public pages have no noindex meta tag or X-Robots-Tag header. Check with a crawler after deployment, not just in the config.

• 301 redirects from old URLs when replacing a shopBlockers

  Map every old product, category and content URL with traffic or backlinks to its closest new page. Test the map with a crawler; avoid chains and blanket redirects to the home page.

• Unique titles and descriptions for each templateHigh

  Product: name, key attribute and brand. Category: category plus a qualifier. No duplicates across variants or paginated pages.

• Canonical tags and faceted navigation under controlHigh

  Filter and sort parameters point to the base category or are set to noindex, variant URLs point to the right canonical, and pagination stays indexable.

• Product structured data is validHigh

  Product with Offer (price, currency, availability), aggregateRating only for real reviews, plus shippingDetails and hasMerchantReturnPolicy. Validate with the Rich Results Test.

• XML sitemap submittedHigh

  Generated automatically with canonical 200 URLs only, and submitted in Google Search Console and Bing Webmaster Tools. Both are verified for the production domain.

• Google Merchant Center feed approvedRecommended

  For free listings and Shopping ads. Feed prices and availability match the product page exactly; shipping and returns settings are complete.

• Out-of-stock and discontinued products have a policyRecommended

  Temporarily unavailable: keep the page live with status 200 and OutOfStock. Permanently gone: 301 to the closest alternative or 410.

• hreflang set for language or country versionsRecommended

  Each version references all the others and itself, plus x-default. Do not force redirects by IP without a way to switch back.

• Social sharing tags and icons in placeRecommended

  Open Graph tags on product pages with the right image, title and price. Favicon and Apple touch icon present.

• Full-site crawl finds no broken linksHigh

  Crawl the whole site with Screaming Frog or Sitebulb: no internal 404s, no links to staging and no orphaned categories.

You cannot fix what you did not measure from day one, and wrong revenue data leads to wrong ad spend.

• The purchase event fires once per order with correct valuesBlockers

  GA4 purchase with transaction_id, value, currency, tax, shipping and items. Reloading the thank-you page must not duplicate revenue.

• The full ecommerce funnel is trackedHigh

  view_item_list, view_item, add_to_cart, begin_checkout, add_shipping_info, add_payment_info, purchase and refund.

• Payment gateways excluded as referrersHigh

  Add PayPal, Przelewy24, PayU and 3-D Secure domains to unwanted referrals so sales are not credited to the bank.

• Internal and test traffic filtered outHigh

  Office IP addresses and your test orders are excluded, and staging does not send data to the production property.

• Ad platform conversions are deduplicatedHigh

  Meta Pixel with the Conversions API, Google Ads enhanced conversions and the TikTok Events API: browser and server events share an event_id so they count once. All of them respect the consent state.

• Analytics revenue reconciles with the shopHigh

  Compare one day of orders in the admin, GA4 and the payment provider. Expect a gap from refused consent and blockers; a gap above roughly 20% usually means a tracking bug.

• UTM conventions and a launch dashboard readyRecommended

  Campaign naming rules, plus a dashboard with sessions, conversion rate, average order value, revenue, top products and payment failures.

These messages are part of the contract and the main support channel after the purchase.

• Every transactional email tested with a real orderBlockers

  Order confirmation, payment received, awaiting payment, shipped, delivered, cancelled, refunded, return received, welcome, password reset, email change and abandoned cart.

• Links in emails point to productionBlockers

  No staging URLs or localhost images, the tracking link works, and the order link opens only for the right customer.

• The order confirmation contains the required detailsBlockersEU

  Seller identity, items, prices including VAT, delivery cost, payment method, delivery address, withdrawal information and the terms, attached or included.

• Emails render well in the main clientsHigh

  Gmail on web, iOS and Android, Apple Mail, and Outlook desktop and web, in light and dark mode. Include a plain-text version.

• Sender name and reply-to address setHigh

  A recognisable sender name, replies going to a monitored support inbox, and messages landing in the inbox rather than spam (check with mail-tester.com).

• Internal notifications reach the teamHigh

  New order, low stock, failed payment webhook, new return, new review and contact form messages go to people or a shared channel, not one personal inbox.

• SMS notifications configured, if usedRecommended

  Sender ID registered, opt-in stored and content written in the customer's language.

An account takeover gives attackers saved addresses, order history and sometimes stored payment methods.

• Passwords hashed with a modern algorithmBlockers

  Argon2id or bcrypt. A minimum length of at least 8 characters and a check against breached passwords instead of forced complexity rules.

• Password reset is safeBlockers

  Single-use tokens that expire within an hour, sessions invalidated after a reset, and no hint about whether an email address is registered.

• Login attempts limitedHigh

  Throttle by IP and account, add a bot challenge after failures and alert on spikes of failed logins.

• Customers can delete their account and get their dataHighEU

  Self-service or a clear request path; order records are kept only as long as accounting rules require.

• Customers migrated from the old shop can sign inHigh

  Password hashes are compatible or there is a forced reset flow, order history is attached to the right accounts, and marketing consents migrate with their proof.

• Social login and passkeys tested, if offeredRecommended

  Production OAuth client IDs and redirect URIs are registered for the live domain.

Launch week brings the most questions and the least patience.

• Contact options are visibleHigh

  Email, phone or chat with opening hours, and a response time you can actually keep.

• FAQ covers delivery, returns, payment and sizingHigh

  The answers match the terms exactly.

• The team is trained on the admin panelBlockers

  Find an order, change an address, resend a confirmation, cancel, refund in full or in part, issue a corrective invoice, create a return and add a manual order.

• Ready replies preparedRecommended

  Where is my order, payment failed, wrong item, damaged parcel, withdrawal request and invoice correction.

• Guests can check their order statusRecommended

  With the order number and email address, without an account.

Most shop traffic is mobile. Test on real phones, not only in a resized desktop browser.

• Tested on real devices and browsersBlockers

  Safari on iPhone (current and one older iOS), Chrome on Android, Samsung Internet, and desktop Chrome, Safari, Firefox and Edge.

• The narrowest screens checkedHigh

  At 320–375 pixels: no horizontal scrolling, tap targets at least 24 by 24 pixels (44 is better), and a sticky add-to-cart bar that does not cover content.

• Navigation and filters workHigh

  The mega menu on touch screens, filter combinations with no results, sort orders, and pagination or infinite scroll that keeps the position after going back.

• Translations and formatting completeHigh

  No untranslated strings, correct currency formats (1 299,00 zł or $1,299.00), dates, decimal separators and plural forms.

• Edge-case orders placedHigh

  Maximum quantities, many line items, very long names and addresses, diacritics and emoji in names, a company order with a VAT number, and a gift card combined with a card payment.

• Every form submitsHigh

  Newsletter, contact, back-in-stock alerts and review submission.

• The browser console is cleanHigh

  No JavaScript errors or failed network requests on key pages.

Assume something will fail in the first week. What matters is how quickly you notice.

• Uptime monitoring on key URLsBlockers

  Home, a product page, the cart, checkout and the payment webhook endpoint, checked every one to five minutes from several regions, with alerts to a phone.

• Synthetic checkout test scheduledHigh

  A script that adds a product to the cart and reaches the payment step without paying raises an alert when checkout breaks.

• Error tracking and logs in placeHigh

  Sentry or similar on frontend and backend, logs centralised and retained, and no card data, passwords or tokens in logs.

• Business alerts configuredHigh

  An alert when orders per hour drop to zero during business hours, the payment failure rate spikes or webhook deliveries fail.

• Backups automated and a restore testedBlockers

  Database and media backed up at least daily, stored off-site and encrypted. A restore has actually been carried out into a test environment and timed.

• Incident runbook and contacts readyHigh

  Who is on call during launch week, contacts at the host, payment provider, developer and carrier, and the steps to enable maintenance mode and roll back.

• Access to every account documentedHigh

  Who can access hosting, DNS, registrar, payments, email, analytics and ad accounts. The company owns every account and controls recovery methods.

The sequence for the switch itself.

• Code and content freeze agreedHigh

  No feature changes 24–48 hours before launch; fixes only.

• Test orders, customers and coupons removedBlockers

  Delete or anonymise test orders and accounts, disable test discount codes and reset reports if the platform allows it.

• Final backup taken just before the switchBlockers

  Note the exact release version that was deployed.

• Smoke test right after the DNS switchBlockers

  On a phone using mobile data: home, search, product, add to cart, checkout, a real card payment, the confirmation email, the order in the admin panel, then a refund.

• Search Console and live analytics checkedHigh

  Sitemap submitted, no crawl errors, and the real-time report shows traffic and the smoke-test purchase.

• Caches purged and warmedHigh

  CDN and application caches cleared after the final deployment, and key pages visited to warm them up.

• Payment, email and error dashboards openHigh

  Watch the payment provider dashboard, email delivery logs, error tracking and server load for the first few hours.

• Soft launch before the announcementRecommended

  Take orders from friends or newsletter subscribers for a day or two before ads and PR send traffic.

• Review after 72 hoursRecommended

  Orders against expectations, checkout abandonment, the top errors, support questions and delivery performance. Turn the findings into the next task list.