Skip to content
BlackFig

Launch checklist for founders

AntPublished 4 min read

Quick answer

Before launch, test every core flow on a real phone, secure your keys and access rules, switch Stripe to live mode with live webhooks, cover the UK GDPR basics, add a sitemap and page titles, set up analytics and error alerts, and plan who answers support in the first week.

On this page
  1. Why it matters
  2. Product and QA
  3. Accounts and security
  4. Payments
  5. Data and privacy
  6. SEO and sharing
  7. Analytics and monitoring
  8. Hosting and domains
  9. Launch day and the first week
  10. Run a soft launch first
  11. Common misses
  12. Next step

Most launch problems are boring ones: a webhook still pointing at test mode, a sign-up form that fails on Safari, an error nobody was alerted to. This is the list I work through with founders before an app goes public, grouped by area so you can hand sections to different people.

There's a PDF version of this checklist too. Use the download form on this page and you'll get the same items with tick boxes, ready to print or share with your team.

Why it matters

You only launch once to most of your audience. People who hit a broken sign-up or a confusing empty screen on day one rarely come back to check whether you fixed it. A checklist doesn't make the product better, but it stops avoidable mistakes from wasting the attention you worked to get.

It matters more for apps built with AI tools. Lovable, Bolt, v0 and the rest are excellent at getting a prototype working. They're less reliable at the parts nobody sees in a demo: access rules, live payment configuration, error handling and mobile edge cases.

Product and QA

Product and QA

  • Every core flow tested end to end on a real phone, on mobile data
  • Tested in Safari and Chrome, signed in and signed out
  • Empty states for a brand-new account explain what to do first
  • Error messages are readable, with no raw stack traces or blank screens
  • Loading states on anything that takes more than a moment
  • Forms handle double-clicks, back buttons and refreshes
  • Placeholder text, test data and lorem ipsum removed

Accounts and security

Accounts and security

  • No secret keys in client code or the repository
  • Database access rules tested with a second account that should see nothing
  • Password reset and email verification work with a real inbox
  • Admin pages protected on the server, not just hidden in the menu
  • Rate limits or CAPTCHA on sign-up and contact forms
  • Backups switched on, and one restore tested

The second-account test is the one that finds the most. Sign up as a new user and try to load another user's records by changing an ID in the URL or the API call. If anything comes back, stop and fix it before launch. My free health check flags the common versions of this in AI-built apps.

Payments

If you take payments with Stripe, its go-live checklist is worth reading in full. The points that catch founders out:

  • Objects created in a sandbox, such as products, prices and coupons, aren't usable in live mode. Recreate them in live mode and update the IDs your code uses.
  • Live webhook endpoints are registered separately from test ones, and must handle delayed, duplicate and out-of-order events.
  • Error handling should treat a declined card (card_error) differently from a problem on your side (invalid_request_error), and show the user something sensible for each.
  • Rotate your API keys before launch in case they were saved somewhere outside your codebase during development.

Payments

  • Live API keys in production environment variables only
  • Products and prices recreated in live mode, and their IDs updated
  • Live webhook endpoint registered and tested with a real small payment
  • Webhook handler ignores duplicate event IDs
  • Refund made and checked end to end
  • Receipts, VAT details and business address correct

My guide to adding Stripe to an AI-built app covers the set-up in detail.

Data and privacy

For a UK company, the main items are the ICO data protection fee, a privacy notice written for your actual app, consent for non-essential cookies and marketing emails, and processor terms with your suppliers. I've covered each one, with links to the ICO guidance, in GDPR basics for UK founders.

Data and privacy

  • ICO fee checked and paid if required
  • Privacy notice linked from sign-up, waitlist and footer
  • Analytics and ad tags load only after consent, unless an exception clearly applies
  • Marketing email consent is separate and optional
  • Data processing terms accepted with each supplier
  • Account deletion removes data from every tool, not just the database

SEO and sharing

You don't need an SEO strategy on day one, but you need the basics in place so search engines and link previews work.

Google's documentation says a single sitemap can hold up to 50,000 URLs or 50MB uncompressed, you can submit it in Search Console's Sitemaps report or with a Sitemap: line in robots.txt, and Google ignores the priority and changefreq values. In Next.js, both files can be generated from the app directory:

// app/robots.ts
import type { MetadataRoute } from "next";
 
export default function robots(): MetadataRoute.Robots {
  return {
    rules: { userAgent: "*", allow: "/", disallow: ["/app/", "/api/"] },
    sitemap: "https://yourapp.com/sitemap.xml",
  };
}
// app/sitemap.ts
import type { MetadataRoute } from "next";
 
export default function sitemap(): MetadataRoute.Sitemap {
  const base = "https://yourapp.com";
  return [
    { url: `${base}/`, lastModified: new Date("2026-11-09") },
    { url: `${base}/pricing`, lastModified: new Date("2026-11-09") },
  ];
}

SEO and sharing

  • A unique title and meta description on every public page
  • Share images set, and checked by pasting a link into a messaging app
  • Sitemap generated and submitted in Google Search Console
  • robots.txt keeps logged-in areas and the API out of search
  • Staging and preview sites set to noindex
  • A favicon and app icons in place

Analytics and monitoring

Analytics and monitoring

  • Analytics tracks the few events that matter: sign-up, first key action, payment
  • Sign-up source recorded on the user record
  • Error tracking with alerts to email or Slack
  • Uptime checks on the home page, sign-up and checkout
  • Logs searchable by user or request

Keep analytics small at launch. Three or four events you actually look at beat fifty you never open. My guide to setting up analytics for an MVP has the event list I start from.

Hosting and domains

Hosting and domains

  • Production domain connected, with HTTPS and the www redirect decided
  • Environment variables set for production, not copied from preview
  • Functions running in the region closest to your database
  • Hosting, domain, database and email accounts in the company's name
  • Email sending domain verified so messages don't land in spam
  • A rollback plan: you know how to redeploy the previous version

The region point is easy to miss. Vercel Functions default to iad1 in Washington, D.C., and Vercel recommends running them in the same region as your database, or as close as possible. If your database is in London, a London function region (lhr1) removes a transatlantic round trip from every query.

If your app still lives on the AI tool's own hosting, read moving off Lovable and Bolt hosting before launch rather than after.

Launch day and the first week

Launch day and the first week

  • Launch on a day you're free to watch and fix things
  • A support inbox someone checks several times a day
  • A short list of known issues and their workarounds
  • Personal follow-up with the first users
  • A daily check of errors, sign-ups and payments for the first week
  • One small fix shipped each day, so early users see it improving

For getting people in the door, my guide to getting your first 100 users covers the hand-recruiting that works better than any launch post.

Run a soft launch first

The cheapest way to find launch problems is a week with a small group of invited users before the public launch. Ten to twenty people is plenty. Pick people who match your target user, not friends who will be polite.

Give them one job: use the product for something real, and tell you where they got stuck. Watch your error tracking and analytics while they do. A soft launch tests the checklist itself, because the things you ticked off in theory either hold up with real accounts and real data or they don't.

It also gives you something to say on launch day. A line such as "tested by 15 local vendors before launch" is a stronger opening than "launching today", and the feedback often changes what you put on the home page.

Keep a simple log during that week: what broke, who reported it, and whether it's fixed. Anything still open on launch morning goes on the known issues list, so support can answer quickly instead of investigating from scratch.

Common misses

The items I see skipped most often:

  • Stripe still in test mode somewhere. Usually the webhook secret or a price ID.
  • No error alerts. The app breaks overnight and the first you hear is a polite email two days later.
  • Analytics before consent. The tag sits in the root layout and fires on every page.
  • The empty state. It looks fine with demo data and baffles a real new user.
  • Accounts in the wrong name. The domain or hosting sits on a freelancer's or an agency's account.
  • The ICO fee. Quick to sort, and easy to forget.

Next step

This checklist is the last step of a bigger journey. My prototype to product guide covers everything leading up to it, and the guide to launching an AI-built app goes deeper on the fixes AI tools tend to leave.

If you'd rather not tick these off yourself, my Launch package takes a prototype to production: payments, hosting, analytics and the fixes in between, priced from the MVP Build and agreed in writing. Book a call and bring your list.

Sources

The launch checklist for founders, as a PDF

About 40 checks across legal, payments, domain and email, analytics, backups and support.

You get the PDF now and two short follow-ups over the next week. Reply “stop” and the rest never arrive.

Questions founders ask

How long before launch should I start this checklist?

Two to three weeks for a small app. Most items take minutes, but the ones that uncover problems, such as testing on real phones or switching payments to live, need time to fix.

Is there a PDF version of this checklist?

Yes. Use the download form on this page and I'll send you the PDF, which has the same items with tick boxes.

What do founders most often forget at launch?

Live Stripe webhooks, error alerts, and the empty states a brand-new user sees. Close behind are the ICO fee and analytics loading before consent.

Do I need a soft launch first?

It helps. A week with a small group of invited users finds the problems a public launch would make expensive.

Ant

Product designer who builds MVPs, based in Nottingham. 10+ years designing digital products, and the only person at BlackFig. More about me