# Website QA checklist ## Content and copy - [ ] **Blocker:** Is all placeholder text gone (lorem ipsum, TODO, sample names, AI tool default text)? - How to check: Search every page and the page source for lorem, TODO, example, test, and your builder's name. - [ ] Has every page been proofread for spelling and grammar? - How to check: Read aloud or use a spell checker on the live pages, including buttons and error messages. - [ ] **Blocker:** Are phone numbers, emails, addresses and prices correct everywhere they appear? - How to check: List every place they appear (header, footer, contact, emails, schema) and compare. - [ ] Do all images load, look sharp and have the right crop on phone and desktop? - How to check: Scroll every page on a phone and a large screen. - [ ] Is the copyright year and company name correct in the footer? - How to check: Check the footer on any page. - [ ] Do empty states explain what to do (empty cart, no orders yet, no results)? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Use a brand new account and look at every list or dashboard. - [ ] Are error messages written for humans (no raw codes, stack traces or 'undefined')? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Trigger errors: wrong inputs, offline, expired session. - [ ] Is the favicon set and visible in browser tabs and bookmarks? - How to check: Open the site in a new tab and on a phone home screen. - [ ] Are dates, times, currencies and units shown in the right format for your audience (for example US$ vs CA$, English and French in Canada)? - How to check: Check prices, dates and emails with US and Canadian settings. ## Links and navigation - [ ] **Blocker:** Do all links work, with no 404s? - How to check: Run a link checker (for example Screaming Frog free or an online broken link checker). - [ ] Do the logo and main menu go to the right pages on every page? - How to check: Click through the full menu, including dropdowns and the mobile menu. - [ ] Does the mobile menu open, close and scroll correctly? - How to check: Test on a small phone, including landscape. - [ ] Is there a helpful 404 page that returns a real 404 status? - How to check: Open yoursite.com/this-page-does-not-exist and check the status in developer tools. - [ ] **Blocker:** Do old URLs redirect to new ones (if this replaces an old site)? - How to check: Test the top old URLs from analytics or Search Console; each should 301 to the right new page. - [ ] Do phone and email links work on phones (tap to call, tap to email)? - How to check: Tap them on an iPhone and an Android. - [ ] Do external links open where you intend and use rel=noopener when opening a new tab? - How to check: Check links to social profiles and partners. - [ ] Do Back, Forward and Refresh in the middle of a flow work without errors or duplicate submissions? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Use them during signup, checkout and forms. ## Forms and emails - [ ] **Blocker:** Does every form deliver its submission where it should? - How to check: Submit each form with a real email and confirm it arrives in the inbox, CRM or database. - [ ] **Blocker:** Do form and system emails land in the inbox, not spam? - How to check: Send to Gmail, Outlook and iCloud. Check SPF, DKIM and DMARC pass in Gmail's 'show original'. - [ ] Does every form show clear errors and keep what the user typed? - How to check: Submit each form empty and with a bad email. - [ ] Does every form have spam protection that does not block real people? - How to check: Check for a honeypot, CAPTCHA or rate limit; submit as a normal user on a phone. - [ ] Is there a success message or thank you page after submitting? - How to check: Submit each form and look at what happens next. - [ ] **Blocker:** Do links in every email point to the live site (not staging, preview or localhost)? - How to check: Open every system email (welcome, reset, receipt, notifications) sent from production and click each link. - [ ] Do the addresses you publish (contact@, support@) actually receive mail? - How to check: Send a test email to each from an outside account. ## Browsers - [ ] **Blocker:** Does the site work on iPhone Safari? - How to check: Test on a real iPhone (current iOS). Safari is about half of mobile visits in the US and Canada. - [ ] **Blocker:** Does the site work on an Android phone in Chrome and Samsung Internet? - How to check: Test on a Samsung Galaxy or similar, 360 to 384 pixels wide. - [ ] **Blocker:** Does the site work on desktop Chrome, Safari, Edge and Firefox? - How to check: Check key pages and flows in each; Edge is about 15% of desktop in the US and Canada. - [ ] Does nothing scroll sideways or overlap on small phones (320 to 375 pixels wide)? - How to check: Use developer tools device mode at 320 px and a real small phone. - [ ] Does the site work on tablets in portrait and landscape? - How to check: iPad at 820 by 1180 and an Android tablet at 800 by 1280. - [ ] Is the layout right on common laptop sizes (1366, 1440, 1536 and 1920 pixels wide)? - How to check: Resize the browser or use developer tools. - [ ] Does the site look right in dark mode (if the device is in dark mode)? - How to check: Turn on dark mode on a phone and a computer. - [ ] Do pop ups, cookie banners and chat widgets stay out of the way of buttons and fields on phones? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Complete the main flow on a phone with the cookie banner still showing. - [ ] Does the site still work with ad blockers and privacy browsers (Brave, Safari with tracking protection, Firefox strict mode)? - How to check: Complete the main flow with an ad blocker on; forms and checkout must not depend on tracking scripts. ## Speed - [ ] Do key pages pass Core Web Vitals (LCP 2.5 s or less, INP 200 ms or less, CLS 0.1 or less) on mobile? - How to check: Run PageSpeed Insights on the home page and top landing pages. - [ ] Are images compressed and sized for the screen? - How to check: Check large images in PageSpeed Insights or the Network tab; use WebP or AVIF where possible. - [ ] Does the site stay usable on a slow mobile connection? - How to check: Throttle to Slow 4G in developer tools and use the main flow. - [ ] Do pages avoid layout jumps while loading (fonts, images, ads)? - How to check: Reload on a phone and watch for content moving. - [ ] Does the page still work if a third-party script (chat, analytics, reviews, fonts) fails or loads slowly? - How to check: Block each third-party domain in developer tools (Network request blocking) and reload. ## SEO and sharing - [ ] **Blocker:** Is the site allowed to be indexed (no leftover noindex or robots.txt block from staging)? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Check robots.txt and the meta robots tag on live pages. - [ ] Does every page have a unique title and meta description? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Crawl the site with Screaming Frog (free up to 500 URLs) or check each page's source. - [ ] Does each page have one clear H1? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Use a crawler or the browser's accessibility tree. - [ ] Is there an XML sitemap submitted to Google Search Console and Bing Webmaster Tools? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Open /sitemap.xml and check it lists only live, indexable pages. - [ ] Does sharing a link show the right title, description and image (LinkedIn, Facebook, Slack, WhatsApp)? - How to check: Paste key URLs into a message or a social preview checker. - [ ] Does every URL resolve to one version (https, www or not, trailing slash or not)? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Try http://, https://, with and without www and the trailing slash; all should redirect to one. - [ ] Is structured data valid (Organization, products, FAQ, breadcrumbs as relevant)? _(Business or marketing website, Online store)_ - How to check: Test key pages in Google's Rich Results Test. - [ ] Do all images have meaningful alt text (or empty alt if decorative)? - How to check: Crawl for missing alt or check with an accessibility tool. - [ ] Does every indexable page have a correct self-referencing canonical tag? _(Business or marketing website, Online store, App built with AI tools)_ - How to check: Check the canonical in the page source of key templates; it should be the page's own clean https URL. - [ ] If the site has several languages or countries, are hreflang tags correct and reciprocal? _(Business or marketing website, Online store)_ - How to check: Check each language version links to all others and to itself. - [ ] Are staging and preview sites hidden from Google (password, noindex or both)? - How to check: Search Google for site:your-staging-domain and check the staging robots settings. ## Accessibility - [ ] Can you use the whole site with only the keyboard, with a visible focus outline? - How to check: Tab through each page and complete the main flow. - [ ] Does text have enough contrast (4.5:1 for normal text)? - How to check: Use a contrast checker or the browser's accessibility panel. - [ ] Does every form field have a visible label that screen readers announce? - How to check: Test with VoiceOver or NVDA. - [ ] Does the site still work at 200% zoom? - How to check: Zoom to 200% in the browser and use the main flow. - [ ] Are buttons and links at least 24 by 24 pixels, or spaced apart, on touch screens? - How to check: Check small icons, close buttons and footer links on a phone. - [ ] Does each page have a language set and a descriptive title? - How to check: Check the html lang attribute and the browser tab title. - [ ] Do videos have captions and does nothing autoplay with sound? - How to check: Play each video. - [ ] Does an automated scan show no serious issues? - How to check: Run WAVE or axe DevTools on key pages. Automated tools find only part of the issues, so also do A01 to A05. - [ ] Is help or contact information in the same place on every page? - How to check: Check header, footer and help links across page types (WCAG 3.2.6). ## Security basics - [ ] **Blocker:** Is the whole site on HTTPS with a valid certificate and no mixed content warnings? - How to check: Check the padlock on every page type; look for warnings in the console. - [ ] **Blocker:** Are there no secret keys in the site's code (API keys, service keys, passwords)? - How to check: Search page source and JavaScript files for sk_live, sk-, service_role, secret, password. - [ ] **Blocker:** Are staging, admin, debug and test pages blocked from the public? - How to check: Try /admin, /debug, /test, /staging, /.env and /.git on the live domain. - [ ] Are basic security headers set (HSTS, X-Content-Type-Options, frame protection, a content security policy where possible)? - How to check: Check the response headers in developer tools or a security header scanner. - [ ] **Blocker:** Can one user never see or change another user's data? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: With two accounts, change IDs in URLs and requests from account A to account B's records. - [ ] **Blocker:** If you use Supabase or Firebase, are database rules locking data to its owner? _(App built with AI tools, Web app with accounts)_ - How to check: Supabase: Row Level Security on for every table, policies tested. Firebase: no 'allow read, write: if true' rules. - [ ] Are prices, quantities, roles and limits checked on the server, not only in the browser? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Try negative quantities and changing prices or roles in requests. - [ ] Are logins, signups, resets and AI or paid API features rate limited? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Send many requests quickly and confirm they get limited. - [ ] Are dependencies free of known critical vulnerabilities? - How to check: Run npm audit or your platform's dependency scanner and update critical packages. - [ ] **Blocker:** Are debug mode and detailed error pages turned off in production (no stack traces, SQL or file paths shown)? - How to check: Trigger errors (bad URLs, bad form input, bad API calls) on the live site and read the responses. - [ ] If the site has AI features, are they protected against prompt injection, data leaks and runaway costs? _(App built with AI tools, Web app with accounts)_ - How to check: Use the AI chatbot and AI features test cases; set rate limits and provider spending caps. ## Accounts and data - [ ] **Blocker:** Do signup, login, logout and password reset work end to end, including the emails? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Use the login, signup and forgot password test cases with a fresh account. - [ ] Has the app been tested with a fresh, non-admin account, not just the builder's own account? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Create a new normal user and use every main feature. - [ ] **Blocker:** Can users delete their account (required for iOS and Android apps with accounts)? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Find and complete account deletion in settings. - [ ] Are backups running and has a restore been tried once? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Check your database provider's backup settings and do a test restore. ## Store and payments - [ ] **Blocker:** Does a full test order work end to end, including confirmation email and the order in your admin? _(Online store)_ - How to check: Use the payment provider's test mode and test cards. - [ ] **Blocker:** Do declined payments never create orders, and does double clicking Pay charge only once? _(Online store, App built with AI tools)_ - How to check: Use the decline test card and double click Pay in test mode. - [ ] **Blocker:** Are taxes and shipping correct for your main regions (for example US states and Canadian provinces)? _(Online store)_ - How to check: Check out with addresses in each main region. - [ ] **Blocker:** Is the payment provider switched from test mode to live mode, with live keys only? _(Online store)_ - How to check: Make one small real purchase and refund it. - [ ] Do coupon codes follow their rules (expiry, minimum spend, one per customer, no stacking)? _(Online store)_ - How to check: Use the coupon test cases in the cart and checkout section. - [ ] Are refund, return and shipping policies published and linked from checkout? _(Online store)_ - How to check: Click each policy link from the checkout page. ## Analytics and tracking - [ ] Is analytics installed once (not twice) on every page? - How to check: Use Tag Assistant or the analytics debug view. - [ ] Are key conversions tracked once each (form submit, signup, purchase)? - How to check: Complete each conversion in debug mode and check one event fires. - [ ] Do tags respect cookie consent where required? - How to check: Decline cookies and confirm analytics and ad tags do not fire (or use consent mode). - [ ] Is Google Search Console (and Bing Webmaster Tools) verified for the live domain? - How to check: Check ownership in each tool. ## Legal and privacy - [ ] **Blocker:** Is there a privacy policy that matches what you actually collect and use? - How to check: Compare the policy with your forms, analytics, cookies and third-party tools. - [ ] Are terms of service published and accepted where needed? _(Web app with accounts, Online store, App built with AI tools)_ - How to check: Check signup and checkout. - [ ] Is there a cookie banner or notice if you use non-essential cookies for visitors where it is required (for example the EU or Quebec)? - How to check: Visit in a private window and check what loads before consent. - [ ] Do marketing emails and forms follow CAN-SPAM (US) and CASL (Canada): opt-in, unsubscribe link, physical address? - How to check: Check signup forms and a sample marketing email. ## Launch day and after - [ ] **Blocker:** Is the domain connected, with www and non-www both working and redirecting to one version? - How to check: Visit both versions on mobile data (not your office wifi). - [ ] Is uptime monitoring and error logging set up, with alerts to a real person? - How to check: Use an uptime monitor and an error tracker; trigger a test alert. - [ ] Has someone who did not build the site tried to use it and break it? - How to check: Give a fresh tester the main tasks without help and watch where they struggle. - [ ] Is there a rollback plan if launch goes wrong? - How to check: Know how to restore the previous version and the database in minutes. - [ ] Have you re-tested the main flows on the live domain after launch? - How to check: Repeat the blocker checks on production within an hour of going live. - [ ] Are usage limits and billing alerts set on paid services (AI APIs, database, email, SMS)? _(App built with AI tools)_ - How to check: Set spending caps and alerts in each provider dashboard. - [ ] Is there a short list of what to watch in the first 48 hours (errors, signups, orders, emails, support inbox) and who watches it? - How to check: Write it down and assign names before launch.