Website QA checklist

How to use the checklist

Work through the groups in order, ticking each check only when it has actually been done on the site that will go live, not on a copy that differs from it. If a check does not apply, leave it unticked and say why in the notes, so whoever reads the export can tell the difference between "not needed" and "forgotten". When you are finished, build the summary and download or copy it. The export lists every check with its state, followed by your notes.

A tick is a claim, not proof. If the checklist will be used to approve a launch, add who checked each group and on which devices, so the claim can be followed up.

Why these checks

The list is ordered by business impact: it starts with the flows that carry business value and ends with the release mechanics. Each group links to a longer guide or service page if you want detail.

The checks, in full

The same 38 checks appear here as plain text, so the list can be printed or used without JavaScript.

Forms and user flows

• Every form submits and the message reaches the right inbox.
• Required fields show clear errors and keep what the visitor typed.
• Confirmation pages and emails show the right wording.
• Search returns results and handles a search with no matches.
• Logins, bookings or checkout steps complete from start to finish.

Detail: testing contact forms.

Links and content

• No broken internal links.
• External links go where they claim to.
• Placeholder text, test pages and dummy products removed.
• Phone numbers, prices, opening hours and dates are correct.
• Images load at a sensible size and have suitable alt text.

Browsers and devices

• Current Chrome, Edge, Firefox and Safari on desktop.
• Safari on an iPhone and Chrome on an Android phone.
• Layout holds from 320 px wide up to a large monitor.
• Text zoomed to 200 percent stays readable and usable.
• Phones turned sideways show the content without clipping.

Detail: cross-browser testing in 2026.

Accessibility

• Every control works with the keyboard alone, with focus visible.
• Form fields have labels, and errors are given in text.
• Text and controls meet WCAG contrast minimums.
• Page titles and headings describe the content.
• An automated checker was run on key templates and its results reviewed.

Security settings

• Every page loads over HTTPS and plain HTTP redirects to it.
• The certificate is valid and renews automatically.
• Security headers are set, such as HSTS and X-Content-Type-Options.
• No backup, configuration or debug files can be downloaded.
• Admin accounts reviewed; CMS, theme and plugins up to date.

Detail: pre-launch security configuration checks.

Search metadata

• Each page has its own title and description.
• Canonical tags point at the live domain, not staging.
• Any staging noindex has been removed from live pages.
• The XML sitemap lists live URLs and robots.txt does not block them.
• Old URLs redirect to their closest new equivalent.

Performance

• Core Web Vitals checked on the main templates.
• Images compressed and served at the size they display.
• Third-party scripts reviewed and the unneeded ones removed.
• Caching and compression switched on at the server.

Release

• A backup exists and a restore has been tried.
• Analytics and the cookie banner behave as agreed.
• A rollback plan is agreed with whoever deploys.
• Sign-off recorded by the person who owns the launch.

What the checklist does not do

It does not test your site. It records what people say they checked. For a structured outside pass over the same ground, with evidence on every finding, see the pre-launch QA review.