Your WordPress site just went live. Here is a problem nobody mentions upfront: the moment a site stops being a staging environment, a small set of tasks become urgent. Not “nice to have” — urgent. Search indexing is still disabled on roughly a third of sites I inherit from other developers. Caching is misconfigured on half of them. No backup was taken after the final round of copy edits. GA4 is firing, but to the wrong property ID.
This checklist covers what to do in the first two hours, the first 24 hours, and the first 30 days. I’ve ordered everything by how badly things go wrong if you skip it.
First 2 hours: before you share the URL
These five tasks take under 10 minutes total. Skip any one of them and you’re in a position where real visitors are hitting the site while something is quietly broken.
Confirm search engine indexing is on. Go to Settings → Reading in wp-admin and confirm that “Discourage search engines from indexing this site” is unchecked. WordPress leaves this on by default in development environments, and it gets carried into production more often than it should. A site with this checked will not rank — Google sees it, respects it, and moves on.
Take a manual backup right now. Before anything else changes on the live site, run a backup with WPVivid or UpdraftPlus and confirm the job completes successfully. Your host may offer automated daily backups — verify they are actually running, not just listed as a feature. If a last-minute edit breaks the database, this backup is the restore point.
Verify SSL is working correctly. Load the site in Chrome, click the padlock, and confirm the certificate is valid and shows your domain. Then type http:// before your URL and confirm it redirects to https://. A mixed-content warning (padlock with a warning triangle) means some assets are still loading over HTTP — usually images or scripts loaded by a plugin — and needs fixing before Google indexes the page.
Submit your sitemap to Google Search Console. Open GSC → Sitemaps, paste your sitemap URL (typically /sitemap_index.xml if you are using Rank Math), and submit it. Then use the URL Inspection tool on your homepage and click “Request Indexing.” This does not guarantee same-day indexing, but it starts the clock.
Test every form on the site. Submit each contact form, quote request, newsletter signup, and booking form from a real email address — not a test placeholder. Confirm the notification arrives in the correct inbox, not the spam folder, and that any autoresponder or redirect fires correctly. This breaks far more often than it should, usually because the staging SMTP settings did not carry over to production.
First 24 hours: performance baseline
Run Google PageSpeed Insights on your homepage and one representative interior page before you start optimizing anything. Note your LCP, INP, CLS, and total score. This is your baseline — if scores drop after a plugin update or config change, you will know exactly what caused it.
If you are not on managed WordPress hosting (Kinsta, WP Engine, Cloudways), install a caching plugin now. WP Rocket is the most complete option at €49 per year. LiteSpeed Cache is free and performs extremely well on LiteSpeed servers. W3 Total Cache is free and broadly supported but takes more configuration to set up properly. The WP Rocket vs W3 Total Cache vs LiteSpeed Cache comparison covers what to choose for your hosting setup.
If you are using Cloudflare, verify the DNS entry shows an orange cloud (proxied), not grey (DNS only). Grey means Cloudflare’s CDN, WAF, and DDoS protection are inactive even though the nameservers are pointing at Cloudflare.
Open Chrome DevTools → Network → filter by “Img” and check whether images are being served as WebP. If you are still delivering JPEG and PNG at full size, your LCP score will reflect that. Smush, ShortPixel, or Imagify convert existing images on upload and can process your existing media library in bulk.
First 24 hours: search and analytics setup
Google Search Console is the most important tool you will look at in the first 30 days. If you have not connected it yet: add your property, verify via HTML tag or DNS record, and submit your sitemap. GSC takes two to three days to start populating data, so connecting it on launch day means you have real numbers when you need them.
For Rank Math users: go to Rank Math → Analytics and connect your Google Search Console account. This pulls GSC impressions, clicks, and keyword data directly into your WordPress dashboard without needing to switch between tabs.
For GA4: use the GA Debugger Chrome extension to confirm your Measurement ID is firing on every page, including the thank-you page after a form submission. The most common failure is a GA4 property ID entered correctly in a plugin, but the plugin pointing to the wrong account or connected to the wrong data stream. The extension shows hits in real time so there is no ambiguity.
First 24 hours: security
Wordfence Free gives you an immediate security scan with no configuration required. Activate it, run the scan from Wordfence → Scan, and review the results. A brand-new site should come back clean. If it flags malware on a site that was just built, your FTP credentials, cPanel login, or staging environment was compromised — contact your host before doing anything else.
Brute-force protection needs to be active before the site gets indexed. Bots scan WordPress login pages within hours of a new domain appearing in DNS. Wordfence’s rate-limiting handles this out of the box. If you are using a separate plugin like Limit Login Attempts Reloaded, verify it is active and configured.
The default “admin” username is a known attack target. If a user with the username “admin” still exists in your wp-admin, create a new Administrator account with a different username, reassign any posts to it, and delete the “admin” user. This takes three minutes and removes one of the most commonly exploited entry points.
For a deeper look at hardening beyond the basics, the essential WordPress security practices guide covers two-factor authentication, XML-RPC, file permissions, and database prefix changes. If you have been hacked before or are in a high-risk industry, read it before launch rather than after. If something goes wrong, bug fixes and emergency rescue is available with same-day response.
The first 30 days
At two weeks: check GSC Coverage. Go to GSC → Pages and look at the “Not indexed” section. “Discovered — currently not indexed” means Google found the URL but hasn’t crawled it yet, which is normal for new sites with low crawl budget. “Crawled — currently not indexed” means Google visited the page and decided not to include it. That usually points to thin content, a noindex tag left in from development, or a canonical pointing to a different URL. Each one needs individual investigation.
At four weeks: Core Web Vitals field data. CWV data in GSC is based on real Chrome users and takes approximately 28 days to accumulate for a new site. At the four-week mark, go to GSC → Core Web Vitals and compare your real-user LCP, INP, and CLS against the PageSpeed lab scores you measured at launch. If real-user data is significantly worse than lab data, the culprit is usually a third-party script (live chat, Facebook Pixel, Intercom) that doesn’t show up in lab tests. The WordPress performance guide covers how to identify and defer third-party scripts without breaking them.
Plugin update discipline. The first time a plugin update notification appears, read the changelog on the plugin’s WordPress.org page before clicking Update. For the first month on a live site, update one plugin at a time and check the site after each one. Do not bulk-update a production site without a backup you can restore in under five minutes. WPVivid’s automated backup schedule — daily for the first month, then weekly after that — is the safety net that makes this manageable.
If monitoring all of this manually sounds like a part-time job, a WordPress maintenance care plan covers plugin updates, automated backups, uptime monitoring, and monthly GSC health checks on a schedule, so nothing falls through the gap between launch day and “when I get around to it.”
Checks people forget
The 404 page. Does it match your site’s design? A default WordPress “Not Found” page on an otherwise custom-designed site tells visitors something is incomplete. Check it by visiting /xyz-does-not-exist on your domain.
Favicon. If the browser tab still shows the WordPress “W” icon, the favicon has not been set. Set it under Appearance → Customize → Site Identity, or through your theme’s settings. It also appears in bookmarks, history, and mobile home screen shortcuts, so it matters more than it gets credit for.
Social preview. Paste your URL into OpenGraph.xyz and see what LinkedIn, X, and Facebook will display when someone shares the link. Missing Open Graph image, wrong title, or no description are common on new sites. Rank Math sets these from your featured image and meta description, but verify rather than assume.
Mobile navigation. Test your main menu and any dropdown submenus on a real iOS device, not just a browser window resized to a small width. Touch targets, hover states, and dropdown behavior frequently differ between DevTools simulation and real Safari on an iPhone.
301 redirects from old URLs. If this site replaced an existing one, confirm all old URLs that had inbound links or search rankings are redirecting correctly. A missed redirect on a page that ranked means losing that traffic immediately. The Redirection plugin handles this and logs 404s so you can catch any you missed.
What to do if something breaks after launch
If a plugin update or hosting change breaks the site after go-live, the sequence is: restore from your WPVivid backup first, investigate second. Debugging a broken production site while it is down costs you visitors and erodes trust. If you do not have a recent backup to restore from, that is the more serious problem to fix — a WordPress emergency rescue with same-day response is available for exactly this situation.
For sites that need ongoing performance improvements — LCP past the 2.5s threshold, failing Core Web Vitals, slow WooCommerce checkout — WordPress speed optimisation covers the full audit and fix, including caching, image delivery, and third-party script management at a fixed price.
For a more technical version of this checklist aimed at developers handling handovers and enterprise launches, see the advanced WordPress launch checklist.
