Launch week is not the time to discover your payment webhook fails, your admin password is shared by six people, or nobody tested on a phone with slow data.
Philippine web products — customer portals, booking sites, internal ops tools — go live in messy real environments: GCash and card payments, SMS providers, staff on Android with intermittent signal, customers who message on Messenger instead of filling forms. A pre-launch checklist turns panic into sequence.
Use this before any public or staff-facing product you depend on for revenue or operations.
Scope and acceptance
- Critical user paths documented and signed off — not "everything works"
- Known limitations listed and communicated to staff
- Out-of-scope items deferred with written phase-two note
- Success metrics defined — what you measure in week one
If nobody can name the five things that must work on day one, you are not ready.
Authentication and permissions
- Individual staff accounts — no shared admin login
- Role permissions tested — receptionist cannot reach finance exports
- MFA enabled on hosting, email, payment dashboards, production admin
- Contractor and agency access reviewed — remove what is not needed
- Password reset and lockout flows tested
Data and migration
- Production data migrated or entered; counts validated against source
- Test records removed from production
- Backup taken before cutover; restore tested at least once this month
- Archive plan for old spreadsheets or legacy tool — read-only, named owner
Payments and money paths (if applicable)
- Live payment test with real small amount — refund or void cleanly
- Webhook or callback logs monitored — payment success updates the right record
- Failed payment, timeout, and duplicate submission handled with clear user message
- Receipt or confirmation email/SMS actually arrives
- Reconciliation export matches payment provider dashboard
Philippine customers abandon fast when money feels uncertain. Test like a skeptical buyer.
Notifications and integrations
- SMS, email, push — each template tested with real addresses and numbers
- Third-party APIs using production keys, not sandbox left connected by mistake
- Error alerts go to someone who responds — not a black hole inbox
- Rate limits and provider quotas understood for launch traffic
Performance and devices
- Core pages load acceptably on mid-range Android over mobile data — not just office WiFi
- Forms work on common browsers your staff and customers use
- File uploads sized and typed correctly; large files do not silently fail
- Public routes do not expose admin URLs, debug bars, or stack traces
Security basics
- HTTPS everywhere; certificates valid
- Environment secrets not in repository or client-side code
- File upload restrictions — type, size, storage location
- Basic rate limiting or bot protection on public forms
- Privacy notice matches data you collect; consent where required
See our security basics for PH SME apps if you have not reviewed these areas.
SEO and public content (customer-facing sites)
- Titles and meta descriptions on key pages
- Indexing rules correct — staging not indexed, production sitemap submitted
- Analytics and conversion tracking verified
- Contact forms and inquiry routing reach the right people
- Google Business Profile and key listings match live URLs and phone numbers
Staff readiness
- Named launch owner on client side — decisions in hours, not days
- Training completed for daily tasks; SOP for top ten scenarios
- Support channel for launch week — who staff message when stuck
- Customer-facing messaging ready if behavior or hours change
Deployment and rollback
- Deployment steps documented; not tribal knowledge in one developer's head
- Rollback plan — previous release or maintenance mode message
- Monitoring for errors and uptime; someone watches dashboards launch day
- On-call agreement with your vendor — response time expectations written
Day-one smoke test (production)
Run immediately after go-live:
- Complete one full customer or staff journey end to end
- Trigger one failure on purpose — bad card, invalid form — confirm handling
- Confirm notification received
- Check admin record matches what customer saw
- Verify backup job scheduled
After launch
Plan daily check-ins for week one — review error logs, fix adoption friction, compare metrics to baseline.
Need a launch review?
If go-live is close and nobody has run a checklist like this, contact us. We can review your staging environment, critical paths, and cutover plan — or tell you what must slip before production is responsible. For builds delivered with launch discipline built in, see custom systems & web applications.
