You have just paid for a new website. It looks good. The agency sent over the login details. Job done.
In a lot of cases, not quite. I review websites regularly as part of my work and the same gaps come up repeatedly, including on sites built by established agencies with solid reputations. Not through carelessness, but because there is no industry standard for what "finished" actually means.
This is what I check before any site I build goes live. If yours launched recently, it is worth running through the list.
A privacy policy is not optional. If your site collects any personal data, including names, email addresses or analytics data, you are legally required to tell visitors what you do with it. It needs to be written for your specific business rather than copied from a template, and it needs to be linked clearly in the footer.
Cookie consent carries the same weight. If you run Google Analytics, Meta Pixel or any other tracking, you need explicit consent before those scripts fire. A banner saying "we use cookies" with no option to decline does not meet the requirement. Neither does one that sets cookies before the visitor has clicked anything.
This became more pressing in June, when the Data (Use and Access) Act 2025 came into force and added a mandatory complaints procedure alongside larger penalties. The detail is in what changed in UK data law, and the compliance update service covers the documents if you would rather have them handled.
SSL should be active across every page rather than just the homepage. Mixed content warnings, where a page loads over HTTPS but pulls resources over HTTP, affect both trust signals and rankings.
301 redirects need testing if any URLs changed during the build. A page that existed at one address and now returns a 404 is a lost ranking and a broken experience for anyone who bookmarked or linked to it.
Core Web Vitals are worth checking before launch rather than after. Layout shifts, slow loading and render-blocking resources are all easier to fix before the site is live and indexed. That work sits under technical SEO and it is far cheaper at this stage.
Google Search Console should be verified and the sitemap submitted on day one. Without it you have no view of how Google is crawling the site, whether pages are indexed, or which queries are driving traffic.
All tracking should be verified firing correctly after consent is given rather than before. If Analytics fires before a visitor accepts cookies, every session recorded from that point is non-compliant data.
Contact forms need testing end to end, from submission through to delivery, including confirmation emails. A form that looks functional and silently fails is one of the most common post-launch problems, and it can run for months before anyone notices.
Beyond the technical checks, a site should launch ready to be found:
That last one catches more sites than you would expect. A noindex tag left over from staging keeps a brand new site invisible indefinitely.
You should finish a project owning your domain, your hosting, your admin access and your analytics accounts, with training on how to update the site yourself. Anything less means the site is not really yours. There are five questions worth asking about this before you commission anyone in this piece on hiring a web designer or SEO.
This is not about finding fault with other agencies. Most of the gaps I see come from builds moving fast with nobody owning the final sign-off.
If you are not sure whether your site has these in place, a website audit covers all of it and comes back as a branded PDF within 48 hours with a walkthrough call. For the wider picture across search, email, tracking and paid, the Marketing Audit is the fuller version.

Free
SEO Audit