AI-Generated Website Deployment Checklist: 15 Things to Check Before Going Live

AI coding tools make it easier than ever to create a website. You can generate a React application, landing page, dashboard, API integration, or even a complete prototype in a short amount of time. But getting the code to work is only the first step.

Before sending real users to the website, run through this checklist.

Quick Answer

Before deploying an AI-generated website, verify these 15 areas: production build, runtime errors, API keys, environment variables, authentication, authorization, dependencies, forms, routes, static assets, domain, HTTPS, mobile layout, performance, and recovery and rollback.

1. Run the Production Build

Do not deploy only because the development server works. Run the project's production build. Make sure it completes successfully. The exact command depends on the framework. Check the generated output directory and confirm that it contains the files expected by your hosting environment.

2. Check Runtime Errors

Open the production website. Open browser Developer Tools. Check the Console. Look for JavaScript errors, failed requests, missing resources, and authentication failures. Fix important errors before launch.

3. Check API Keys

Search the project for credentials. Make sure private keys are not included in frontend code, public environment variables, Git repositories, or static files. If a private key is already exposed, rotate it according to the provider's instructions.

4. Check Environment Variables

Create a list of variables required in production. Separate public configuration, which are values intentionally exposed to browsers, from private secrets, which must remain server-side. Do not assume that an environment variable is private simply because it is called an environment variable.

5. Test Authentication

If your website has accounts, test sign up, login, logout, password recovery if applicable, session expiration, and invalid credentials. Do not test only the happy path.

6. Test Authorization

Make sure users cannot access resources they do not own. For example, a user should not be able to access another user's private record simply by changing an ID in a URL or request. Authorization must be enforced server-side where sensitive resources are involved.

7. Review Dependencies

Inspect the project's dependencies. Remove packages that are unnecessary. Review important security advisories using the package manager and relevant official security information. Do not blindly install packages because an AI coding tool suggested them.

8. Test Forms

Test every important form. Try valid input, empty input, very long input, invalid email addresses, unexpected characters, and duplicate submissions. Confirm that errors are understandable.

9. Test Every Important Route

Do not only test the homepage. Open main pages, dashboard pages, login routes, dynamic routes, forms, and important deep links. If the website uses client-side routing, test refreshing a deep route directly.

10. Check Static Assets

Verify images, CSS, JavaScript, fonts, and icons. A website can look perfect locally and lose assets after deployment because of incorrect paths or build configuration.

11. Connect the Domain Correctly

Before launch, confirm the root domain, www hostname if used, DNS configuration, and hosting project mapping. Make sure the domain points to the intended website.

12. Verify HTTPS

Open the production website using HTTPS. Check the certificate, correct hostname, redirect behavior, and mixed-content warnings. Do not assume that domain connection automatically means every HTTPS configuration is correct.

13. Test on Mobile

AI-generated websites often look good on a desktop screen but still contain layout problems at smaller widths. Test navigation, buttons, forms, tables, cards, modals, and text wrapping. Use actual mobile testing where possible.

14. Check Performance

Before launch, look for obvious performance problems. Check large images, unnecessary JavaScript, slow API requests, excessive third-party scripts, fonts, and large bundles. Do not optimize blindly. Measure first, then address the largest problems.

15. Have a Recovery Plan

Before sending users to the website, know how you would recover from a bad deployment. Consider the previous working version, source control, deployment history, database backups where appropriate, credential rotation process, and rollback procedure. A deployment is not complete simply because the first version went live.

The Final 5-Minute Test

Before launch, pretend you are a new visitor. Open the domain in a private browser window. Check the homepage, navigation, main call-to-action, forms, mobile layout, HTTPS, and important routes. Then test the application from the perspective of a user who is not already logged in.

The Most Important AI-Specific Rule

Never use AI generated it as your production approval process. Use AI generated it, I reviewed it, I tested it, I verified production configuration, I deployed it. That is a much safer workflow.

FAQ