Checklist for launching a site

When a site is going live it faces a variety of performance, user interaction, security, maintenance, and quality assurance concerns. Remember to secure file permissions and ownership, and see how to serve Drupal from /web for shared hosting.

Every site is different, but this checklist will get you started with common site launch tasks. It will also get you thinking about the kind of tasks that may be needed for your specific site's needs.

Security and audit

• Upgrade Drupal Core and Contrib modules to the latest version.
• Check that admin password is secure, and secure admin super user (#1).
• Turn off on-screen error reporting at Configuration > Development >Logging and errors.
• On People > Permissions page, check the permissions for anonymous and authenticated users.
• On the Configuration > People > Account settings page, verify that account creation settings are as you intend (can users create their own accounts, and do they need approval?).
• Check Reports > Status report and make sure there are no warnings or errors.
• Check Reports > Recent log messages for errors and warnings, such as missing files or URLs.
• Enable the Update Manager module, and configure it under Reports > Available updates > Update Manager settings, making sure a real email is used, and not a test address.
• For auditing, install Production check, Security Review, and Site Audit to check for many of the easy-to-make mistakes that render your site insecure.
• Modules such as Login Switch, Automated Logout, Login Security, Password Policy, and Drupal Perimeter Defence can help secure your site. Read Drupal 10: Adding Extra User Account Protection for more.
• Go through Secure file permissions and ownership on the server.

Performance

• Go to Configuration > Development > Performance and set "Browser and proxy cache maximum age" to a time span which works well. Check that Views are cached.
• Under Bandwidth Optimization enable "Aggregate and compress CSS files", and "Aggregate JavaScript files". Note: May cause redeclaration in rare cases.
• Check performance with Webprofiler and fix slow database queries.
• Uninstall development modules, such as Devel.
• Confirm OPcache + object cache (Redis/Memcached) are running.
• Test PHP workers under simulated load with ab, gremlins.js or k6.
• Check that staging domain URLs are fully purged from CDN.

User Interaction

• Protect your forms against spam and attacks.
  • What kind of forms are anonymous and authenticated users able to access on your site?
  • Have you enabled CAPTCHA, Antibot, Honeypot, Riddler or an anti-spam service?
  • Be sure that all publicly exposed email addresses are protected from spam bots with solutions like Obfuscate Email or a custom obfuscator.
• Verify that the site email address at Configuration > System > Basic site settings is not a test address.
• Verify email addresses in other modules that send notifications, such as Update.
• Verify the text of email messages your site generates.

Domain

• Get a HTTPS certificate via your hosting provider, or use Let’s Encrypt which is free.
• Redirect to a URL with or without www, patch the .htaccess file. Alternatively, insert this at the top of settings.php (replace "example.org" with your domain) right after <?php:
  

  // Remove www
  if ($_SERVER['HTTP_HOST'] == 'www.example.org') {
    header('HTTP/1.0 301 Moved Permanently');
    header('Location: https://example.org'. $_SERVER['REQUEST_URI']);
    exit();
  }

• Update API keys for modules that make use of them, such as Mailchimp or Postmark.

Backups, Maintenance and Monitoring

• Cron - If cron is not running, your database will get bloated.
• Backups - Regular database backups are essential. Check out how to automate backups of a Drupal web site for more information.
• Statistics - You'll want to monitor your site going forward. Do you plan to use Drupal core statistics, or have you set up another service such as Matomo, Plausible, or AWStats?
• Monitor performance and uptime with a self-hosted monitoring tool or a third-party service.

SEO & Indexing

• Create a Sitemap, for example with Simple XML sitemap.
• Check that canonical link, meta description, and similar elements are in place.
• Verify hreflang implementation for a multilingual site.
• Check OpenGraph/Twitter Cards preview, with opengraph.dev or opengraph.xyz.
• Check that the search index is refreshed and at 100%.

Quality Assurance

• Remove test content, such as "lorem ipsum" text, dummy users, or content generated by the Devel module.