The 25-point launch checklist for AI-built websites

Your domain's DNS records point somewhere real, for both the bare domain and www.

Why: If DNS is wrong, the site doesn't exist for visitors — the single most common place AI-built launches stall.

Fix: In your registrar's DNS panel, add the A/CNAME records your host shows you. Both example.com and www.example.com should resolve.

The URL returns a real page (HTTP 200), following any redirects.

Why: Error codes and redirect loops mean visitors get a blank wall instead of your business.

Fix: Check your host's deployment logs. A 404 on the root usually means the deploy failed or the domain is attached to the wrong project.

HTTPS works with a certificate that's valid, trusted, and not about to expire.

Why: Browsers show a full-screen 'Not secure' warning for bad certificates. Nobody types their email into that.

Fix: Most hosts issue certificates automatically once DNS is correct — a failing certificate usually means DNS still points to the old place. Re-check the records, then re-provision.

Typing the plain http:// address lands visitors on the secure https:// version.

Why: Old links and typed addresses come in over HTTP. Without a redirect they hit an insecure or dead page.

Fix: Enable 'force HTTPS' at your host or add a 301 redirect from http:// to https://.

The site lives on your own domain, not a builder subdomain like yoursite.lovable.app.

Why: A builder subdomain says 'unfinished' to customers, can't rank properly, and belongs to the platform — not you.

Fix: Buy a domain, add it in your builder's domain settings, and update DNS at the registrar. This is the exact last-mile step Livecheck does for you.

Page source and JavaScript bundles contain no secret keys (Stripe, OpenAI, AWS, service-role tokens…).

Why: AI builders sometimes inline server keys into browser code. Bots scrape these within hours and run up real bills on your accounts.

Fix: Rotate the leaked key immediately, then move the call behind a server endpoint or edge function. Never ship *_live or service-role keys to the browser.

A secure page doesn't load images or scripts over insecure http://.

Why: Browsers block or flag the insecure pieces — broken images, dead scripts, and a warning in the address bar.

Fix: Change http:// asset URLs to https:// (or protocol-relative). Re-upload anything hosted somewhere that lacks HTTPS.

Baseline headers: HSTS, X-Content-Type-Options, and clickjacking protection.

Why: Cheap, standard hardening. Their absence also signals 'nobody technical looked at this'.

Fix: Add Strict-Transport-Security, X-Content-Type-Options: nosniff, and X-Frame-Options (or a CSP) in your host's headers config.

Every form posts somewhere real — a backend, or a form service like Formspree or Netlify Forms.

Why: The classic AI-site failure: a beautiful contact form wired to nothing. Leads vanish silently and you never know.

Fix: Wire the form to a form endpoint (Formspree, Basin, Web3Forms) or your backend, then do one real test submission and confirm the email arrives.

Internal links resolve — no 404s hiding in the nav or footer.

Why: AI builders generate links to pages that were never created. Dead ends read as abandonment.

Fix: Create the missing pages or remove the links. Check the footer first — that's where generated links to /privacy and /terms usually 404.

A wrong URL returns a proper 404 (or a branded not-found page), not a blank 200.

Why: Soft 404s confuse search engines and strand visitors who follow a bad link.

Fix: Add a custom 404 page in your framework (e.g. not-found.tsx in Next.js) and make sure it returns status 404.

No lorem ipsum, 'Your Name Here', 555 phone numbers, or template variables left in the copy.

Why: One 'email@example.com' in the footer undoes every dollar spent looking professional.

Fix: Search the site for lorem, example.com, 555-, TODO and {{ — replace with real business details.

The page declares a responsive viewport so phones don't render it as a tiny desktop screenshot.

Why: Without it, mobile visitors pinch-zoom through your site. Over half your traffic gives up instead.

Fix: Add <meta name="viewport" content="width=device-width, initial-scale=1"> to the <head>.

A site icon shows in browser tabs and bookmarks instead of a generic globe.

Why: Small trust signal, disproportionately noticed. Default icons whisper 'template'.

Fix: Export a 32px and 180px icon, add favicon.ico to the site root and an apple-touch-icon link.

Images carry alt descriptions for screen readers and broken-image fallbacks.

Why: Accessibility, SEO, and basic ADA hygiene — an easy lawsuit-bait item to clear.

Fix: Give every meaningful image a short alt describing it; decorative images get an empty alt.

The page has a proper H1 so people and crawlers know what it's about.

Why: Generated layouts sometimes style a <div> as the hero title. Crawlers see a page about nothing.

Fix: Make the main headline an <h1> element — one per page.

No stray noindex tag, blocking robots.txt, or X-Robots-Tag header hiding the site from Google.

Why: Preview deploys ship with noindex on purpose — and it silently follows sites to production. Months of 'why no traffic?' with one hidden cause.

Fix: Remove noindex meta tags, check robots.txt isn't 'Disallow: /', and make sure you promoted a production deploy (previews send noindex headers).

A real, right-sized <title> — the headline in Google results and browser tabs.

Why: 'Vite + React' as your Google headline is a real thing that ships on AI-built sites.

Fix: Set a 50–60 character title: what you do + for whom. Every page gets its own.

A meta description that becomes your snippet in search results.

Why: Without one, Google picks random page text — usually the cookie banner.

Fix: Write 140–160 characters selling the click: what you offer, for whom, why you.

og:title, og:description and an og:image that actually loads, so shared links unfurl with a card.

Why: The first place your site appears is a text or a Slack message. No OG tags = a bare grey link.

Fix: Add Open Graph meta tags with an absolute 1200×630 image URL. Test in iMessage or a Slack DM.

A canonical link tells search engines which URL is the real one.

Why: Prevents www/non-www and tracking-parameter duplicates from splitting your ranking.

Fix: Add <link rel="canonical" href="https://yourdomain.com/…"> to each page.

A sitemap.xml exists (or is referenced from robots.txt) listing your pages.

Why: Speeds up discovery of every page, especially on brand-new domains with zero backlinks.

Fix: Generate sitemap.xml (most frameworks have it built in), reference it from robots.txt, and submit it in Google Search Console.

Time to first byte under ~800ms from a cold visit.

Why: Every extra second of wait costs conversions; slow first bytes usually mean a sleeping free-tier server.

Fix: Move off free tiers that sleep, enable caching/CDN at your host, and keep heavy work off the first request.

No multi-megabyte hero images or bloated payloads on the landing page.

Why: AI builders love a 4MB PNG hero. On hotel wifi your site is a white rectangle for ten seconds.

Fix: Compress images to WebP/AVIF, size them to their display width, and lazy-load below the fold.

HTML is served gzip/brotli compressed.

Why: Free 60-80% bandwidth cut; its absence flags a misconfigured server.

Fix: Turn on gzip/brotli at your host or CDN — one config line on most platforms.