WordPress hosting checklist: what to verify before launch

Make HTTPS the normal path

Confirm the production domain has a valid TLS certificate and that HTTP requests redirect to HTTPS. Check both the apex domain and the www version you intend to support.

Security headers such as HSTS can be useful after HTTPS is stable, but enable them deliberately because browsers remember the policy.

Prove the backup can restore

A successful backup job is not the same as a successful restore. Make sure you can recover both the WordPress files and the database, and keep at least one recoverable copy away from the live server.

Update the application before launch

Update WordPress core, the active theme, and plugins. Remove plugins and themes that are not needed. Every extra component increases the amount of software you have to monitor and maintain.

Verify forms and transactional email

Test contact forms, password resets, order notifications, and any other automated mail. A page saying “sent” does not prove the message reached the recipient.

For important transactional mail, use an intentional delivery setup and configure the domain authentication records that service requires.

Measure the pages people will actually visit

Test the homepage, important landing pages, product pages, and checkout or contact path on a phone and a normal connection. Look for oversized images, layout shifts, excessive scripts, uncached responses, and slow third-party services.

Lock down administration

Use unique administrator accounts, strong credentials, multi-factor authentication where practical, and the smallest permissions each person needs. Avoid one permanent shared administrator login.