In this post (6 sections)
In short
- A finished website needs a privacy policy written for your business, and cookie consent that blocks tracking until visitors agree.
- Check SSL on every page, test redirects for any URLs that changed, and fix Core Web Vitals before launch.
- Verify Search Console on day one, and test every form from submission through to the emails it sends.
- You should own your domain, hosting, admin access and analytics, with training to update the site yourself.
You have just paid for a new website. It looks good. The agency sent over the login details. Job done.
In a lot of cases, not quite. I review websites regularly as part of my work and the same gaps come up repeatedly, including on sites built by established agencies with solid reputations. Not through carelessness, but because there is no industry standard for what “finished” actually means.
This is what I check before any site I build goes live. If yours launched recently, it is worth running through the list.
Legal basics
A privacy policy is not optional. If your site collects any personal data, including names, email addresses or analytics data, you are legally required to tell visitors what you do with it. It needs to be written for your specific business rather than copied from a template, and it needs to be linked clearly in the footer.
Cookie consent carries the same weight. If you run Google Analytics, Meta Pixel or any other tracking, you need explicit consent before those scripts fire. A banner saying “we use cookies” with no option to decline does not meet the requirement. Neither does one that sets cookies before the visitor has clicked anything.
This became more pressing in June, when the Data (Use and Access) Act 2025 came into force and added a mandatory complaints procedure alongside larger penalties. The detail is in what changed in UK data law, and the compliance update service covers the documents if you would rather have them handled.
Technical foundations
SSL should be active across every page rather than just the homepage. Mixed content warnings, where a page loads over HTTPS but pulls resources over HTTP, affect both trust signals and rankings.
301 redirects need testing if any URLs changed during the build. A page that existed at one address and now returns a 404 is a lost ranking and a broken experience for anyone who bookmarked or linked to it.
Core Web Vitals are worth checking before launch rather than after. Layout shifts, slow loading and render-blocking resources are all easier to fix before the site is live and indexed. That work sits under technical SEO and it is far cheaper at this stage.
Tracking and Search Console
Google Search Console should be verified and the sitemap submitted on day one. Without it you have no view of how Google is crawling the site, whether pages are indexed, or which queries are driving traffic.
All tracking should be verified firing correctly after consent is given rather than before. If Analytics fires before a visitor accepts cookies, every session recorded from that point is non-compliant data.
Contact forms need testing end to end, from submission through to delivery, including confirmation emails. A form that looks functional and silently fails is one of the most common post-launch problems, and it can run for months before anyone notices.
Search readiness
Beyond the technical checks, a site should launch ready to be found:
- Unique title tags and meta descriptions on every page
- One H1 per page, with a logical heading structure below it
- Descriptive alt text on every meaningful image
- Schema markup for the business, services and any FAQs
- Internal links connecting service pages to each other and to contact
- The staging site blocked from indexing, and the live site unblocked
That last one catches more sites than you would expect. A noindex tag left over from staging keeps a brand new site invisible indefinitely.
Handover
You should finish a project owning your domain, your hosting, your admin access and your analytics accounts, with training on how to update the site yourself. Anything less means the site is not really yours. There are five questions worth asking about this before you commission anyone in this piece on hiring a web designer or SEO.
What this list is for
This is not about finding fault with other agencies. Most of the gaps I see come from builds moving fast with nobody owning the final sign-off.
If you are not sure whether your site has these in place, a website audit covers all of it and comes back as a branded PDF within 48 hours with a walkthrough call. For the wider picture across search, email, tracking and paid, the Marketing Audit is the fuller version.
