---
name: launch-website-checklist
description: Takes a deployed site live on its own domain, covering DNS records, HTTPS, www redirect, security headers, Google Search Console and a final go-live checklist (links, mobile, form, 404, share preview). Use when the user wants to launch a site, connect a custom domain, or run a pre-launch checklist before going live.
license: CC-BY-4.0
metadata:
  category: deployment
  tags: "dns,security,hosting"
  author: johnny-bravo
  version: "1.0"
  updated: "2026-10-31"
  status: published
---

# Launch a website on its own domain

## When to use
- The site is deployed (for example at `my-site.vercel.app`) and you want it on `www.yourbusiness.com.au` and announced.
- You want one last check that nothing embarrassing is broken.
- For the first deployment itself, use `deploy-nextjs-to-vercel`; for launch announcements, use `write-launch-posts-prompt`.

## Handoff
- Reads: the live deployment URL (in `README.md` from the deploy step), `docs/quality-report.md`, and `lib/site.ts`.
- Writes: DNS records at the domain registrar, security headers in `next.config.ts`, and `docs/launch-checklist.md` with every item ticked or explained.

## Steps
1. Commercial check first: a business site on Vercel needs the Pro plan (US$20 per month per developer seat plus tax, per vercel.com/pricing on 2026-10-31), because Vercel's Hobby plan is for personal, non-commercial use only. Upgrade before pointing a business domain at it.
2. Domain: buy it if needed (`.com.au` has Australian eligibility rules; an ABN is the usual way to qualify). In Vercel → Project → Settings → Domains, add both `yourbusiness.com.au` and `www.yourbusiness.com.au`, and choose which one is primary (www is a common choice); the other redirects to it.
3. DNS: at the registrar, add exactly the records Vercel shows on the Domains page: an `A` record for the apex domain and a `CNAME` for `www`. Copy the values from your project's page rather than from a blog post; they can differ per project.
4. Before changing nameservers (instead of single records), copy every existing record, especially `MX` and `TXT` records for email; missing them stops the business's email.
5. Wait for "Valid configuration". Vercel issues the HTTPS certificate automatically. Check `http://` redirects to `https://` and the non-primary host redirects to the primary.
6. Update `site.url` in `lib/site.ts` (and `metadataBase`) to the final domain, redeploy, and confirm `/sitemap.xml` lists the real domain.
7. Security headers in `next.config.ts` via `async headers()` for `source: "/(.*)"`:
   - `Strict-Transport-Security: max-age=63072000; includeSubDomains` (add `preload` only after reading hstspreload.org's requirements)
   - `X-Content-Type-Options: nosniff`
   - `Referrer-Policy: strict-origin-when-cross-origin`
   - `X-Frame-Options: DENY` (or a CSP `frame-ancestors 'none'`)
   - `Permissions-Policy: camera=(), microphone=(), geolocation=()`
   - A Content-Security-Policy is worth adding later; test it in `Content-Security-Policy-Report-Only` first because a wrong CSP breaks analytics, fonts and forms.
8. Stop the `*.vercel.app` production URL competing in search: add `X-Robots-Tag: noindex` for requests whose host is `your-project.vercel.app` (Next.js `headers()` with a `has: [{ type: "host", ... }]` condition).
9. Google Search Console: add a Domain property, verify it with the TXT record Google gives you, then submit `https://www.yourbusiness.com.au/sitemap.xml`.
10. Go-live checklist, written to `docs/launch-checklist.md`:
    - Every nav and footer link works (no 404s); the 404 page itself looks right.
    - Mobile: check on a real phone, in portrait, for text size, tap targets and no sideways scrolling.
    - Contact form: send a real enquiry on the live domain and confirm it arrives and the reply-to works.
    - Share preview: paste the home page into a chat app and check the title, description and image.
    - `/privacy` is linked in the footer and matches what the site collects.
    - Lighthouse on the live URL is no worse than in `docs/quality-report.md`.
    - Favicon, page titles and the business details (phone, address, hours) are correct.
    - Analytics records your own visit.

## Gotchas
- DNS changes can take time to show everywhere; don't keep editing records while you wait.
- Remove any conflicting old `A`, `AAAA` or `CNAME` records for the same name, or the domain stays "Invalid configuration".
- HSTS is sticky: browsers remember it for `max-age`. Start shorter (for example one day) if you're not sure every subdomain has HTTPS.
- Keep the old site, or a redirect, running until DNS has switched, so customers never see an error.

## References
- Vercel, Adding and configuring a custom domain: https://vercel.com/docs/domains/working-with-domains/add-a-domain
- Vercel, Fair use guidelines (commercial usage): https://vercel.com/docs/limits/fair-use-guidelines
- Vercel KB, Avoiding duplicate content with vercel.app URLs: https://vercel.com/kb/guide/avoiding-duplicate-content-with-vercel-app-urls

## Credits
Topic coverage informed by addyosmani/web-quality-skills (https://github.com/addyosmani/web-quality-skills, MIT © 2026 Addy Osmani). The text here is our own.

## Example prompt
"Connect my domain to the site on Vercel and run through a pre-launch checklist so I can go live."