
You have just paid for a new website. It looks good. The agency sent over the login details. Job done.
Except in a lot of cases, it is not quite that simple.
I review websites regularly as part of my work, and the same gaps come up time and again, including on sites built by established agencies with solid reputations. Not because those agencies are careless, but because there is no industry standard for what "finished" actually means.
This post sets out what I check before any site I build goes live. If your site launched recently and you are not sure whether these are in place, it is worth running through the list.
A privacy policy is not optional. If your site collects any personal data, including names, email addresses, or analytics data, you are legally required to tell visitors what you do with it. It needs to be written for your specific business, not copy-pasted from a template, and it needs to be linked clearly in the footer.
Cookie consent is equally important. If you are running Google Analytics, Meta Pixel, or any other tracking, you need explicit consent before those scripts fire. A banner that says "we use cookies" with no option to decline does not meet GDPR requirements. Neither does one that sets cookies before the visitor has clicked anything.
SSL should be active across every page, not just the homepage. Mixed content warnings, where a page loads over HTTPS but pulls in resources over HTTP, can affect both trust signals and rankings.
301 redirects need testing if any URLs changed during the build. A page that existed at one address and now returns a 404 is a lost ranking and a broken experience for anyone who had it bookmarked or linked to it.
Core Web Vitals are worth checking before launch rather than after. Layout shifts, slow load times, and render-blocking resources are easier to address before the site is live and indexed.
Google Search Console should be verified and the sitemap submitted on day one. Without it, you have no visibility into how Google is crawling the site, whether pages are indexed, or what search queries are driving traffic.
All tracking should be verified firing correctly after consent is given, not before. If GA fires before a visitor accepts cookies, every session recorded from that point is non-compliant data.
Contact forms should be tested end to end, from submission to delivery, including any confirmation emails. A form that looks functional but silently fails is one of the most common post-launch problems.
This is not about finding fault with other agencies. Most of the gaps I see are the result of builds moving fast with no one owning the final sign-off checklist.
If you are not sure whether your site has these in place, a Marketing Audit covers all of it and more. You come away with a clear written action plan and a full picture of where your site stands.


Free
Website Health Check