# SaaS launch checklist: what to check before you launch (2026)

> A SaaS product launch checklist in 15 groups: domain, production setup, sign-in, email, payments, security, legal, SEO, speed, monitoring and launch.

Source: https://www.shipanysaas.com/blog/saas-launch-checklist
Published: 2026-10-18 · Updated: 2026-10-18

A SaaS product launch checklist covers what has to work before strangers can find you, sign up and pay: domain and HTTPS, production settings, sign-in, email delivery, live payments, security, legal pages, SEO, speed, monitoring and launch channels. Below are 89 checks in 15 groups, each with the reason it matters.

It follows the pre-launch checklist we ran before shipanysaas.com went live and the production checklist in the kit's docs. Where the kit already handles an item, there is a link to its docs; everything else applies to any SaaS. Work from the top: the early groups decide whether people can sign up and pay, the later ones how many find you.

## What should you check before launching a SaaS?

Check these 15 groups, in this order:

1. Domain, DNS and HTTPS
2. Production setup
3. Sign-in and the core flow
4. Email delivery
5. Payments
6. Security
7. Legal pages
8. Search basics: head tags, sharing and crawling
9. AI search
10. Speed, mobile and accessibility
11. Analytics and monitoring
12. The phone app, if you ship one
13. Positioning and the homepage
14. Launch channels and first customers
15. The first month after launch

## 1. Domain, DNS and HTTPS

1. **The domain sits in an account you own, with auto-renew and the transfer lock on.** Losing the domain loses the business.
2. **One canonical host.** Redirect the bare domain to www, or the reverse, permanently, so search engines see one site.
3. **HTTPS on every page.** Browsers flag plain HTTP, and secure sign-in cookies need it.
4. **Unknown addresses return a real 404.** A page that answers 200 for anything lets junk URLs into the index.
5. **Previews and staging are private.** Search engines and strangers should only find production.

## 2. Production setup

1. **A separate production database and auth project.** Testing against live customer data ends badly.
2. **Every environment variable set on the host.** Missing variables are the usual first-deploy failure; the kit checks its public settings when it builds. See [configuration](https://www.shipanysaas.com/docs/getting-started/configuration).
3. **Migrations applied, seed data left out.** Seed files often create users with published passwords. See [migrations](https://www.shipanysaas.com/docs/database/migrations).
4. **CI runs type checks, lint and tests, and the main branch is protected.** A broken commit shouldn't deploy itself.
5. **Keys rotated after development.** Stripe's [go-live checklist](https://docs.stripe.com/get-started/checklist/go-live) recommends it, in case keys were saved outside your codebase.
6. **A half-page incident plan.** Who gets the alert, where the logs are, how to roll back.

If a coding agent wrote much of the code, read [Claude Code best practices](https://www.shipanysaas.com/blog/claude-code-best-practices) for the review habits that matter before launch.

## 3. Sign-in and the core flow

1. **Site URL and redirect URLs set for the production domain.** Otherwise OAuth and email links fail or point at localhost. See [OAuth providers](https://www.shipanysaas.com/docs/authentication/oauth-providers).
2. **Auth email templates updated.** The kit's templates keep email links working when they open in a different browser. See [email sign-in](https://www.shipanysaas.com/docs/authentication/email-password).
3. **Walk the whole path as a stranger.** Sign up, confirm, sign in, reset the password, invite a teammate, delete the account.
4. **Invitations tested end to end.** Expired, wrong-email and already-member cases included. See [teams and invitations](https://www.shipanysaas.com/docs/features/teams-and-invitations).
5. **Test users removed from production.** Shared demo logins don't belong in your live data.
6. **Data isolation tested.** Sign in as one customer and try to read another's data. The kit's [database tests](https://www.shipanysaas.com/docs/database/tests) do exactly this.

## 4. Email delivery

1. **A real email provider for auth emails.** Supabase's [SMTP guide](https://supabase.com/docs/guides/auth/auth-smtp) says its default sender only delivers to your project team's addresses, at 2 messages an hour, and is "not meant for production use".
2. **SPF and DKIM on the sending domain, plus DMARC.** Google's [sender guidelines](https://support.google.com/a/answer/81126) require SPF or DKIM from everyone, and all three from senders of 5,000+ messages a day to Gmail.
3. **MX records for replies.** Customers answer receipts and invitations, and those replies shouldn't bounce.
4. **One-click unsubscribe on marketing email.** Gmail requires it from bulk senders.
5. **Every template checked in Gmail, Outlook and Apple Mail.** The [email docs](https://www.shipanysaas.com/docs/features/email) cover which emails the kit sends and how.

## 5. Payments

1. **Live keys, live products and live webhook endpoints.** Stripe objects made in a sandbox don't exist in live mode.
2. **The webhook handler tolerates delays, duplicates and any order.** Stripe's go-live checklist names all three. See [webhooks](https://www.shipanysaas.com/docs/billing/webhooks).
3. **Users can't change their own plan.** Only verified payment events should write subscription rows; that is how the kit's database grants work.
4. **One real purchase with a real card.** It proves payouts, receipts and the database write; refund it yourself afterwards.
5. **Sales tax and VAT decided.** A tax tool on your own account, or a merchant of record. [Polar vs Stripe vs Lemon Squeezy](https://www.shipanysaas.com/blog/polar-vs-stripe-vs-lemon-squeezy) compares them.
6. **Refund terms visible before payment.** Disputes start where expectations differ.
7. **A pricing page that answers what, how much, how often and what happens next.** See [SaaS pricing page examples](https://www.shipanysaas.com/blog/saas-pricing-page-examples).

## 6. Security

1. **Two-step sign-in on every service account.** Registrar, DNS, host, GitHub, payments, email and database.
2. **Secret keys on the server only.** Search your client bundle for them before launch.
3. **Row-level security on every table.** In the kit, a test fails if any public table is left without it. See [row-level security](https://www.shipanysaas.com/docs/database/row-level-security).
4. **The admin area behind two-step sign-in.** One stolen password shouldn't open every account.
5. **A rate limit or bot check on open forms.** Bots on sign-up and contact forms burn your email quota.
6. **A security.txt file.** [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116) puts it at `/.well-known/security.txt`, with a Contact and an Expires line under a year ahead.

## 7. Legal pages

1. **A privacy policy that matches what you collect.** Include analytics, payment and email providers.
2. **Terms of service, with your refund rule.** Link them at checkout.
3. **A cookie policy, and consent where the law requires it.** EU visitors bring EU rules.
4. **Your company name and a contact address on the site.** Buyers, payment providers and app stores look for them.
5. **A lawyer's review.** Templates and AI drafts are a start, not advice. In the kit, each page is a Markdoc file you write.

## 8. Search basics: head tags, sharing and crawling

1. **A unique title and description on every page.** They are what a results page shows.
2. **A canonical URL on every page.** It stops duplicates splitting your rankings.
3. **A share image and favicon.** Test previews in Slack, X, LinkedIn and WhatsApp.
4. **sitemap.xml and robots.txt.** Google's [sitemap guide](https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap) says to submit it in Search Console or list it in robots.txt, and that submitting is only a hint.
5. **Structured data that validates.** Organization, product, FAQ and article markup.
6. **Search Console and Bing Webmaster Tools verified.** Read the Pages report two weeks after launch.

The kit's Starter plan ships the sitemap, robots file, page metadata, JSON-LD and share images, plus a blog and docs. See [blog, docs and changelog](https://www.shipanysaas.com/docs/features/content).

## 9. AI search

1. **One plain sentence on the homepage saying what the product is and who it's for.** AI answers quote clear statements.
2. **Facts on pages, not only in images.** Prices, plans, limits and dates as text.
3. **An FAQ and honest comparison pages.** They match the questions people ask assistants.
4. **robots.txt and your firewall allow the crawlers you want.** A blanket bot block hides you.
5. **An llms.txt file.** [llmstxt.org](https://llmstxt.org/) describes it as a proposal, so treat it as cheap, not decisive. The kit serves one.
6. **Mentions on other sites.** Directories, communities and newsletters are where assistants find you.
7. **The same ten buyer questions asked in AI assistants every month.** Note whether you appear.

## 10. Speed, mobile and accessibility

1. **Core Web Vitals in the good range.** [web.dev](https://web.dev/articles/vitals) puts "good" at an LCP within 2.5 seconds, an INP of 200 ms or less and a CLS of 0.1 or less, at the 75th percentile of page loads.
2. **Third-party scripts counted.** Each analytics or chat script costs load time.
3. **A real phone, not only a resized browser.** Safari on iPhone and Chrome on Android, plus Firefox and Edge.
4. **Sign-up and checkout by keyboard alone.** Focus order and visible focus included.
5. **Labels, alt text and contrast.** Screen readers need them.
6. **Dark mode checked, if you offer it.** Hard-coded colours show up here.

## 11. Analytics and monitoring

1. **The funnel tracked.** Visit, pricing, checkout, paid. The kit has PostHog and Usermaven wired in; you add your project keys.
2. **Tags on every link you post.** You'll want to know which channel sold.
3. **Your own visits filtered out.** Launch-week numbers are small enough to skew.
4. **Error monitoring on.** The kit includes Sentry support.
5. **Uptime checks and payment-failure alerts on your phone.** You should hear about an outage before a customer tells you.
6. **Backups understood and a restore tried.** Know what your database plan keeps. See [Supabase pricing](https://www.shipanysaas.com/blog/supabase-pricing).

## 12. The phone app, if you ship one

1. **Apple and Google developer accounts.** Publishing needs both.
2. **A privacy policy URL and data disclosures.** Apple requires both in App Store Connect, and Google Play requires a Data safety form and a privacy policy for every app.
3. **Account deletion inside the app.** App Review Guideline 5.1.1(v) requires it if people can create accounts. The kit's phone app has a delete-account screen.
4. **An equivalent sign-in option alongside Google.** Guideline 4.8 sets rules for apps that use third-party login.
5. **Store listing ready.** Screenshots, description, support URL.
6. **Tested on real devices through TestFlight and Play internal testing.** Simulators miss real-world failures.

[React Native vs Flutter](https://www.shipanysaas.com/blog/react-native-vs-flutter) covers the build and update tools for each.

## 13. Positioning and the homepage

1. **One first buyer named.** A page written for everyone convinces no one.
2. **A headline that says what it is and who it's for.** Visitors decide in seconds.
3. **Prices and plan differences on the page.** Hidden prices read as expensive.
4. **Real proof only.** A demo, screenshots and docs beat invented testimonials.
5. **A next step on every page.** Demo, pricing or sign-up.
6. **A softer option for people not ready to buy.** An email signup or a free guide.
7. **An about page with a real person.** People buy from people.

## 14. Launch channels and first customers

1. **Launch assets ready.** Screenshots, a short demo video, a one-line pitch.
2. **A list of directories and communities, with their rules read.** Self-promotion rules differ everywhere.
3. **A launch day for Product Hunt or Show HN, with you there all day.** Replies matter more than the post.
4. **100 named people who fit, messaged personally.** First customers rarely come from a launch post.
5. **Help before you promote.** Answer questions in the places buyers already talk.
6. **Every buyer asked how they found you.** A checkout question or a line in the welcome email.

## 15. The first month after launch

1. **Day one: reply to everything, fix only what blocks buying.** Everything else waits.
2. **Week one: talk to five buyers or prospects.** Their words go into your copy.
3. **Week two: read the first search queries in Search Console.** They show what people expect from you.
4. **Month one: pick the one funnel step to fix.** One change at a time, so you know what worked.
5. **Every quarter: run this checklist again.** Settings drift, keys expire, links break.

## Where the kit covers the list

Groups 2, 3, 5, 6 and 8 are mostly code, and that is the part shipanysaas ships finished: sign-in, teams and invitations, Stripe or Lemon Squeezy billing with verified webhooks, row-level security with database tests, and the SEO files. Accounts, keys, legal text and launching are yours whichever kit you use. It is one payment, with no subscription; the [pricing page](https://www.shipanysaas.com/pricing) has today's prices and links both demos, and [getting started](https://www.shipanysaas.com/docs/getting-started/getting-started) shows what is in the repository.

## FAQ

### How long before launch should I start this checklist?

Two to three weeks for a first launch. Domain, email authentication, payment approval and search indexing all involve waiting on someone else, so start those first.

### What is the most common thing founders forget?

Email. Auth emails sent from a default sender, a domain without SPF, DKIM or DMARC, and no mailbox for replies are easy to miss because everything works in testing.

### Do I need a lawyer before launching a SaaS?

For the privacy policy and terms, a review is worth it, especially if you sell to the EU or handle personal data. Templates give you a draft, not legal advice.

### Should I launch on Product Hunt?

It can bring a burst of visitors, but treat it as one channel. Personal outreach to people who fit usually brings the first paying customers, and directories and helpful answers in communities keep bringing visitors after launch day.