Site Launch Checklist

Run this checklist on every site before launch or when adding user management.

0 / 9

Security

Data isolation — logged-in users only see their own data

User A must never be able to access User B’s orders, profile, or private content. Every DB query must filter by the logged-in user’s ID.

Input sanitization — clean every field before saving to DB

All user input (forms, URL params, cookies) must be sanitized. Use prepared statements, not just escape functions. Prevents SQL injection and XSS.

Rate limiting — block brute force on login & forms

Max 5 failed login attempts then lock for 15 minutes. Apply to login, registration, password reset, and contact forms.

API authentication — no open endpoints

Every API route that returns or modifies data must require a valid auth token or session. Public APIs are limited to read-only non-sensitive data only.

Password reset links expire after 1 hour

Reset tokens must be single-use and time-limited. Store a hashed token in DB with expiry timestamp. Invalidate on use.

Stability & UX

Error handling — users see clean messages, not raw errors

PHP errors and DB failures must never reach the user. Show a friendly error page. Log the real error server-side only.

Database indexes on all main query columns

Any column used in WHERE, JOIN, or ORDER BY should have an index. Critical for user_id, email, status, created_at. Without it queries slow to a crawl at scale.

Deployment

Blue/green or staging environment exists

Never deploy untested code directly to live. Have a staging URL to test first. Blue/green = two live servers, switch traffic instantly with zero downtime.

All questions in this checklist have been reviewed

This checklist is not exhaustive — it’s a minimum bar. If you’re adding payments or sensitive data, add PCI/GDPR checks on top.