Small business website launch checklist: what to test first

A week before: start the jobs that take days

Some launch tasks sit in someone else's queue, so start them first. If you are setting up a Google Business Profile, the listing that can show your business on Google Maps and in local search, start verification now: Google says its reviews take up to five business days, and occasionally longer. If you are sent a postcard, most codes arrive within 14 days and expire after 30.

While you wait, do not edit your business name, address or category, because Google warns that changes can stop a posted code from working. You cannot choose the method either: Google decides between options such as phone, text, email, video and post, depending on your type of business, region and opening hours.

This is also the week to collect logins. Adding your site to Google Search Console, the free tool that shows how Google sees your pages, often means proving you own the domain by adding a record at your domain provider. Find out now who can log in there, rather than on launch morning.

Launch day: make every address land in one secure place

People and old links will reach you in four ways: with or without www, and starting with http or https. All four should end at the same https address, without a ‘Not secure’ label or a warning page on the way.

If the new site replaces an old one, list the old site's most-visited pages and check that each old address forwards to the matching new page, not to an error or simply the home page. Search results and bookmarks will keep pointing at the old addresses for some time.

Then check that search engines are allowed in. WordPress and many site builders have a setting that hides a site from search engines while it is being built, and it is easy to forget at launch. In Search Console, the URL Inspection tool will tell you whether Google can index your home page; if your site has a sitemap, submit it there too.

Prove the contact form reaches a real person

A form can show a cheerful thank-you message and still lose the enquiry. Since 1 February 2024, Google has required everyone who sends email to personal Gmail accounts to set up SPF or DKIM, two ways of proving a message really comes from the domain it claims. Google says messages that are not authenticated might be marked as spam or rejected, and a website form is a sender like any other.

Two set-ups are worth checking with whoever built the form. In the first, the site sends enquiries from your domain, but your domain's settings do not authorise the server doing the sending. In the second, each enquiry is sent as if it came from the visitor's own address. Google tells senders not to impersonate Gmail addresses in the From line and warns it can affect delivery, so a safer pattern is to send from your own domain and put the visitor's address in the reply-to field.

Use the site on a phone, with a keyboard and zoomed in

Accessibility problems are the norm, not the exception. When WebAIM tested the home pages of the top one million websites in February 2026, 95.9% had detectable failures against the WCAG accessibility guidelines, and 96% of all the errors fell into just six types. For a small site, that is good news: a short list catches most of what automated tools find.

Most of it you can check yourself in one sitting. Put the mouse away and press Tab to move through the page: you should always see where you are, reach every link and button, and be able to send the contact form. Zoom the browser to 200% and check that nothing overlaps or disappears. Click a form field's label; if the cursor jumps into the field, the label is properly linked, which helps a screen reader announce what the field is for.

Then look for the quiet failures. Meaningful images need a short text description of what they show. Icon-only buttons, such as a menu or search magnifier, need a text label, or a screen reader has nothing useful to say. Pale grey text on white often fails contrast checks. Finally, repeat the tour on a real phone with your thumb. Automated tools catch only some problems, so treat a clean result as a start, not proof.

Publish a privacy notice and set up cookies honestly

If your contact form collects names and email addresses, you are handling personal data, and people should be told what happens to it. The ICO, the UK's data protection regulator, says a privacy notice should give your contact details, what information you collect and why, your lawful basis, who you share it with, how long you keep it, people's rights and how to complain. It offers a privacy notice generator for small organisations. Link to the notice from your footer and beside the form.

Cookie advice written a few years ago may be out of date, so check it against the ICO's current guidance. It lists five situations where you do not need consent, including one for analytics. That exception applies only if the sole purpose is aggregate statistics to improve your own site, any analytics provider acts purely on your behalf, you explain this to visitors, and you give them a simple, free way to object. Advertising is different: the ICO says no advertising purpose is exempt, so those tools must wait for a yes.

Before launch, list every cookie and tag the site sets, including those added by plugins and embedded videos, and sort them into essential, analytics that fits the exception, and everything else. If your customers are outside the UK, check the rules where they live.

Hand over the keys: ownership, backups and who to call

One expensive launch mistake surfaces a year later, when the domain comes up for renewal and the reminder goes to a freelancer who has moved on. Before calling the project finished, make sure the business owns every account in its own name, and that the people who built the site have their own logins rather than the main one.