Before you open your website to the public, check these seven things

A pre-launch checklist you can do entirely yourself, with no special tools. Every item comes from problems that keep turning up on websites that are already live.

A website about to launch is usually only checked for whether it looks good and whether the links go to the right place. Those are the two things people can see. The most expensive problems are usually in the things they can't see.

One: every page opens with https, not just the payment page

Try typing your address without https. If it doesn't jump to the page with the padlock by itself, the job isn't finished. A page without encryption lets anyone on the same wifi as your customer see everything the customer types.

Two: the admin login page should not be at the standard address

If your login page is at an address anyone can guess right away, bots will try passwords on it day and night. Moving it doesn't make you safer in theory, but it cuts out almost all of the automated attacks.

Three: files that should not open from outside

Try opening these addresses in a browser. If you see content instead of a not found page, there is a problem to fix fast.

/.env
/.git/config
/backup.zip
/database.sql
/phpinfo.php

The .env file and the .git folder are the two you find most often and the most dangerous, because they hold the database password and the keys to every service you use. Whoever opens them doesn't need to hack anything. They just read them and walk straight in.

Four: error messages must not give away secrets

Try breaking the site once, for example by typing a random address or filling in a form with data in the wrong format. If the screen shows which file and which line, or prints a database command, you are handing a map to anyone looking for a way in.

Five: prices and permissions must be decided on the server

Everything sent from the user's browser can be changed, including product prices, quantities and user IDs. If the system trusts the numbers it is sent, someone who knows how can buy a $150 item for 60 cents.

Six: forms must block repeated submissions

A contact form with no limit on how often it can be sent becomes a way to push thousands of spam emails a day into your inbox, until the real messages get buried in the pile.

Seven: keep backups somewhere other than the site itself

This one prevents nothing at all, but it turns your worst day into half a day of lost time. What matters is keeping them somewhere else, because if they sit on the same machine, the day that machine has a problem, both disappear together.

And you must have actually restored from them at least once. A backup that has never been restored is no better than none, because you find out it doesn't work on exactly the day you need it.

Summary

You can check all seven yourself without any special tools. It takes no more than an hour, and it covers most of the problems I find on websites that are already live.