Built with a specific tool? See the checklists for Lovable, Bolt, Cursor, v0 and Replit.
Security
What bots try on every new site.
- Site loads over HTTP: how to force HTTPS
- Missing HSTS header: what it is and how to add it
- No Content-Security-Policy header: how to add a CSP
- Clickjacking: missing X-Frame-Options or frame-ancestors
- Missing X-Content-Type-Options: nosniff header
- Missing Referrer-Policy header: stop leaking full URLs
- Missing Permissions-Policy header: what to set
- API key exposed in page source: how to check and fix it
- .env or .git folder publicly downloadable: how to check
- Directory listing enabled ('Index of /'): how to turn it off
- Mixed content: HTTPS page loading HTTP scripts or styles
- Cookies missing Secure, HttpOnly or SameSite flags
- Outdated JavaScript libraries: old jQuery and Bootstrap
- Open redirect: fixing ?redirect= and ?next= links
- Source maps exposed in production: how to turn off
- API key in your JavaScript bundle: how to find it and fix it
Legal
What regulators, app stores and payment providers expect to find.
- Does my website need a privacy policy?
- Does my app need terms of service? What to include
- Do I need a cookie banner? Tracking scripts without consent
- Google Analytics without a privacy notice: the rules
- No contact details on your website: why it matters legally
- Should my website have a copyright notice in the footer?
- YouTube, Google Maps and Google Fonts embeds and GDPR
- Website accessibility basics: lang, alt text, titles
- Trackers loading before cookie consent: how to check your site
- Cookies set before consent: which ones need permission
- Which third parties does my website contact?
- Privacy policy link missing on some pages
- Inner pages missing titles and alt text
Polish
Small things that make a site look finished and get found.
- Missing favicon: how to add one properly
- Page title still says 'Vite App'? How to fix it
- Missing meta description: what Google shows instead
- No robots.txt: do you need one and what goes in it
- No sitemap.xml: how to add one so Google finds your pages
- Link preview not showing: missing Open Graph tags
- Soft 404s: missing pages returning 200 OK
- security.txt: tell researchers how to report a vulnerability
- JavaScript errors on page load: finding silent failures