Site Launch Checklist

Site Launch Checklist

Pre-launch audit and setup workflow for shipping a new website. Opinionated for Cloudflare DNS + Vercel hosting + PostHog + Legal context.

Interaction style (READ FIRST)

This skill is intentionally interactive. Use ask_user_input_v0 aggressively instead of assuming. Ask one question at a time with 2-4 tappable options. The user will tap, not type.

Always ask these questions at the start of a run (one at a time, in this order):

1. Site type: doc-site | marketing/lead-gen | SaaS-app | training/paid-course | personal-portfolio
2. Migration: greenfield-new-domain | migration-need-301-redirects | replacing-existing-on-same-domain
3. Multilingual: single-locale | en | fr+en | other-multi
4. PostHog setup: hogpost.samber.dev | set-up-new-proxy | skip-PostHog
5. AI scraper policy: use-default-for-site-type | customize-per-bot | block-all
6. Browser tool available: claude-chrome-extension | playwright | neither-skip-browser-checks

Ask again at every decision point throughout the phases, including:

• Whether to install Sentry / BetterStack / Crisp (depends on site type, ask explicitly)
• www vs apex canonical preference (most sites: apex; ask anyway)
• Which AI bots to allow if user chose customize-per-bot
• CSP tightness level: strict-default-src-none | balanced-allow-self | permissive-for-marketing
• Whether to skip a phase entirely (e.g., skip Phase 3 if non-FR site)

Never proceed past a decision point without explicit user input. Verbose checklists without checkpoints are not the goal.

Never install any MCP server or skill without explicit user confirmation. Always ask via ask_user_input_v0 before running npx skills add, claude mcp add, or any equivalent install command — even when the skill selection workflow proposes a curated subset.

How to use this skill

1. Run the start-of-session questions above.
2. Walk the user through phases 1-10 in order. For each phase: a. List items, ask if any should be skipped. b. For each remaining item, run the verification command (see "Verification tools" below). c. Report pass/fail. On fail, ask the user if they want to fix now or queue for later.
3. End with a status report grouped by phase, with blockers, recommended fixes, and optional improvements clearly separated.

Companion skills

Six skill packs are useful for site launches. Never install full multi-skill packs. The actual subset to install is decided at invocation time based on the site type the user confirms.

Pack inventory

| Pack | What it covers | Typically useful for | | --- | --- | --- | | AgriciDaniel/claude-seo | SEO + GEO + schema + hreflang + sitemaps audits, parallel sub-agents | All site types | | addyosmani/web-quality-skills | Lighthouse, Core Web Vitals, accessibility, performance, best practices | All site types | | trailofbits/skills | Security audit (OWASP, headers, dependencies) | All site types | | aaron-he-zhu/seo-geo-claude-skills | 20 SEO+GEO skills, CORE-EEAT + CITE frameworks, /seo: slash commands | Content-heavy sites, competitive niches | | coreyhaines31/marketingskills | ~30 marketing skills (CRO, copywriting, ads, popups, email, paywalls, etc.) | marketing/lead-gen, SaaS-app, training/paid-course | | jonathimer/devmarketing-skills | 33 developer-marketing skills (persona, docs-as-marketing, technical tutorials, etc.) | doc-site, SaaS-app for developers |

Skill selection workflow (run at session start)

After the user confirms site type, for each pack relevant to that site type:

1. List available sub-skills: npx skills add owner/repo --list
2. Propose a curated subset based on site type and the phases this skill will execute. Match each phase's needs to specific sub-skills the listing returns.
3. Confirm with the user via ask_user_input_v0. Use multi-select when the proposed list has more than 3 items, single-select (install-as-proposed | let-me-modify | skip-this-pack) otherwise.
4. Bulk install the agreed subset: npx skills add owner/repo --skill A B C

Rules:

• Sub-skill names live in the pack, not in this SKILL.md. Always query --list for the current state. Pack contents change.
• Never run npx skills add owner/repo without --skill (that installs everything).
• Site type → packs mapping (which packs to enumerate, sub-skills still selected per workflow):
• doc-site: claude-seo, web-quality-skills, trailofbits, seo-geo-claude-skills, devmarketing-skills
• marketing/lead-gen: claude-seo, web-quality-skills, trailofbits, seo-geo-claude-skills, marketingskills
• SaaS-app: all six
• training/paid-course: claude-seo, web-quality-skills, trailofbits, marketingskills
• personal-portfolio: claude-seo, web-quality-skills, trailofbits, seo-geo-claude-skills (lightweight subset)
• If the user later requests a phase that needs a sub-skill not yet installed, run the workflow again for that single sub-skill rather than re-installing the whole subset.

This avoids importing 80+ skills the user does not need, avoids going stale on sub-skill names, and avoids overfitting to a single pack version.

When delegating during a phase, do not duplicate work this skill orchestrates. Call the specialist with a narrow scope (e.g., "run only the security headers sub-audit on URL X").

Copywriting voice and humanizer pass

Every site has visible marketing copy (hero, features, CTAs, meta descriptions, OG descriptions, blog posts, 404 page text). Two layers of polish are mandatory before launch:

1. Define TONE.md once per site

Ask the user (ask_user_input_v0): "Does this site already have a TONE.md?" (yes-already-exists | no-create-from-template | skip-use-default).

If creating: write it to .agents/TONE.md or repo root TONE.md. See references/templates.md (section "TONE.md template") for the structure.

TONE.md specifies: voice (terse, contrarian, etc.), forbidden patterns (e.g., "delve", "crucial", em dashes, AI-sounding openers), sentence length preference, audience reading level, examples of good and bad sentences from the user's own writing.

2. Run a humanizer pass in the matching language

After every drafting step (whether by a copywriting skill, by hand, or by Claude directly), run a humanizer to strip AI patterns.

Ask the user (ask_user_input_v0) for the site's primary audience language at the start of the session if not already known:

• english-global → npx skills add https://github.com/blader/humanizer --skill humanizer
• french → use samber/humaniseur-fr (custom French humanizer) or equivalent French-tuned skill
• other → install matching humanizer if available; otherwise the skill writes a short language-specific anti-pattern checklist inline

Apply the humanizer to: hero copy, feature descriptions, CTA buttons, meta descriptions, OG/Twitter card descriptions, blog posts, email signup confirmations, 404 page text. Skip for legal pages (mentions légales, CGV) since they have rigid wording requirements.

3. Always reference TONE.md when invoking copywriting skills

When delegating to any copywriting or content-writing sub-skill (selected at invocation per the skill selection workflow), include TONE.md in the prompt context. Pass voice constraints explicitly: "Follow .agents/TONE.md. Avoid the listed patterns. Apply the humanizer after drafting."

Browser interaction preference

Many checks require a real browser (Lighthouse runs, securityheaders.com scan, opengraph.xyz validation, Twitter card validator, mobile viewport, screen reader smoke, Network tab inspection).

Always prefer the Claude Chrome extension. Fall back to Playwright only if the Chrome extension is unavailable. If neither is available, ask the user (ask_user_input_v0) whether to skip browser checks entirely or wait until they enable one.

Verification tools

Most checks are doable from the command line without third-party services. Use these tools inline at every phase. Don't trust panels in Cloudflare/Vercel/Google dashboards alone, verify with curl.

DNS (Phase 1):

dig +short A example.com                          # A record
dig +short AAAA example.com                       # AAAA (IPv6)
dig +short MX example.com                         # MX (mail)
dig +short TXT example.com                        # SPF + verification TXT
dig +short TXT _dmarc.example.com                 # DMARC
dig +short TXT default._domainkey.example.com     # DKIM (selector varies)
dig +short CAA example.com                        # CAA
dig +dnssec example.com | grep RRSIG              # DNSSEC active

TLS / HTTPS (Phase 1):

curl -sIL https://example.com | head             # follow redirects
curl -sI https://www.example.com                 # check www handling
openssl s_client -showcerts -connect example.com:443 /dev/null | openssl x509 -noout -dates

Headers (Phase 4):

curl -sI https://example.com | grep -iE 'content-security-policy|strict-transport-security|x-frame-options|x-content-type-options|referrer-policy|permissions-policy'
# Full header dump:
curl -sI https://example.com
# External graders:
curl -s "https://api.securityheaders.com/?q=https://example.com&followRedirects=on&hide=on" -I | grep -i 'x-grade'

SEO files (Phase 5):

curl -s https://example.com/robots.txt
curl -sI https://example.com/sitemap.xml
curl -s https://example.com/sitemap.xml | head -40
curl -s https://example.com/llms.txt
# Schema (JSON-LD):
curl -s https://example.com/ | grep -A 50 'application/ld+json'
# hreflang:
curl -s https://example.com/ | grep -i hreflang

Open Graph & social (Phase 6):

curl -s https://example.com/page | grep -iE 'og:|twitter:|) and **Schema.org Validator** () — Rich Results Test checks eligibility for rich snippets; Schema.org Validator catches spec violations that Google may silently ignore.
- [ ] Meta tags per page: unique `` (50-60 chars), unique `` (150-160 chars), ``, `` if needed
- [ ] `hreflang` tags on every page if multilingual (every language version declares all alternates including self). Verify with `curl -s URL | grep -i hreflang`.
- [ ] **Keyword analysis using both Google Trends and Ahrefs** (they answer different questions, not interchangeable):
  - **Google Trends** (trends.google.com): trajectory (rising vs declining), geographic distribution (especially FR vs international split), seasonal patterns, related queries breakout, head-to-head comparison of 2-5 candidate keywords. Use Trends to **validate direction and timing** of the SEO bet.
  - **Exploding Topics** (explodingtopics.com): surfaces emerging trends weeks or months before they peak in Google Trends. Use to identify rising queries before competition solidifies and to validate that target keywords aren't already on the decline.
  - **Answer The Public** (answerthepublic.com/en): maps search questions, comparisons, and related queries around a seed keyword. Use to uncover long-tail intent clusters, populate FAQ schema, and identify content gaps.
  - **Ahrefs Keywords Explorer**: monthly volume, keyword difficulty, SERP analysis, CPC, parent topic, traffic potential. Use Ahrefs to **size the opportunity** in absolute terms.
  - Combined output: a ranked shortlist of 3-5 target queries per page, with rationale (volume × difficulty × trajectory × intent match).
  - Delegate to whichever keyword-research sub-skill was installed at session start (selected from the installed packs via the skill selection workflow; typical sources are the SEO+GEO and marketing packs).
- [ ] **AI visibility audit via productrank.ai**: open productrank.ai in a browser, submit multiple category or product searches, run the full AI SEO report. It audits how the site appears in AI-generated answers (ChatGPT, Perplexity, Gemini, Claude). Flag any zero-visibility categories and surface content gaps the AI graders identify.
- [ ] Typo and grammar pass on all visible text content
- [ ] Backlink profile audit: run **Ahrefs Backlink Checker** and **Moz Link Explorer** to assess domain authority and surface toxic or broken inbound links before launch — especially critical on migrations to ensure old-domain equity transfers correctly
- [ ] Internal linking audit: every important page reachable in ≤3 clicks from the homepage

---

## Phase 6: Open Graph & Social Preview

Verify all OG and Twitter tags with: `curl -s URL | grep -iE 'og:|twitter:'`

- [ ] `og:title`, `og:description`, `og:url`, `og:type`, `og:site_name`
- [ ] `og:image` 1200×630px, absolute URL, `og:image:width` and `og:image:height` declared, `og:image:alt` set
- [ ] **Per-page `og:image`**, not one global. For doc sites: generate dynamically from page title. For blog posts: per-article custom image.
- [ ] `og:locale` + `og:locale:alternate` for each language if multilingual
- [ ] Twitter Cards: `twitter:card=summary_large_image`, `twitter:title`, `twitter:description`, `twitter:image`, `twitter:site` (handle)
- [ ] Validate with opengraph.xyz (covers FB, LinkedIn, Slack, Discord, WhatsApp previews) via Claude Chrome extension
- [ ] Validate with Twitter's card validator
- [ ] Manual check: paste URL in a LinkedIn DM, a Slack channel, a Discord, an iMessage. Preview must render correctly in all.

---

## Phase 7: Favicons & Web Manifest

See `references/templates.md` for the `manifest.json` template.

Generate from a single 1024×1024 source PNG using realfavicongenerator.net or favicon.io.

**Minimum modern set:**

- [ ] `/favicon.ico` (multi-res 16/32/48). Verify with `curl -sI https://example.com/favicon.ico`.
- [ ] `/favicon.svg` with embedded `@media (prefers-color-scheme: dark) { ... }` for dark mode. Verify with `curl -sI https://example.com/favicon.svg`.
- [ ] `/favicon-96x96.png` (PNG fallback)
- [ ] `/apple-touch-icon.png` 180×180px, no transparency, opaque background. Verify with `curl -sI`.
- [ ] `/web-app-manifest-192x192.png` (Android PWA icon)
- [ ] `/web-app-manifest-512x512.png` (Android splash)
- [ ] `/manifest.json` referencing both PNGs, with `theme_color`, `background_color`, `name`, `short_name`, `display`. Verify with `curl -s https://example.com/manifest.json | jq .`.

**Skip (deprecated):**

- `mstile-*.png` (Windows tiles)
- `safari-pinned-tab.svg` (deprecated since macOS Big Sur)
- `favicon-16x16.png` / `favicon-32x32.png` (covered by `.ico` and `.svg`)

**HTML head verification:**

```bash
curl -s https://example.com/ | grep -iE 'rel="icon"|rel="apple-touch-icon"|rel="manifest"'

---

Phase 8: Quality Gates

Delegate to addyosmani/web-quality-skills. The skill covers 150+ Lighthouse audits across performance, accessibility, SEO, and best practices.

• [ ] Unlighthouse site-wide crawl: npx unlighthouse --site {site} — crawls all pages and runs Lighthouse on each. Surface pages below 90 on any axis before the per-URL checks.
• [ ] Lighthouse all 4 axes, mobile mode: target ≥90 on each (perf, a11y, best practices, SEO)
• [ ] Lighthouse all 4 axes, desktop mode: target ≥95 on each
• [ ] Core Web Vitals field data (CrUX via PageSpeed Insights): LCP < 2.5s, INP < 200ms, CLS < 0.1, on both mobile and desktop
• [ ] Accessibility (WCAG 2.2 AA via web-quality-skills): keyboard nav works for every interactive element, focus rings visible, color contrast ≥4.5:1 for text, all images have alt, heading hierarchy is monotonic (H1 → H2 → H3), ARIA labels on icon-only buttons
• [ ] Real mobile device test (not just devtools emulator). Use Claude Chrome extension on mobile viewport on a real device or BrowserStack.
• [ ] Cross-browser smoke test: Chrome, Safari, Firefox latest stable
• [ ] Print stylesheet sanity (Cmd+P should not break layout)

---

Phase 9: Ecosystem Cross-linking

Internal cross-linking between owned properties. High-leverage SEO action for any multi-domain owner.

Ask the user: "List the other domains in your ecosystem that are topically r

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: samber
• Source: samber/cc-skills
• License: MIT
• Homepage: https://skills.sh/samber/cc-skills

Install and usage instructions live in the source repository linked above.