# Production Launch Checklist

## Technical

- [ ] WordPress and PHP versions meet the Health Check requirements.
- [ ] HTTPS is active across the site.
- [ ] Pretty permalinks are enabled.
- [ ] v9 theme and v9 core plugin are active.
- [ ] Homepage and Primary Menu are assigned.
- [ ] Mobile menu, search and mobile dock work on actual phones.
- [ ] Native event registration and volunteer forms work and submissions are stored correctly.
- [ ] Each event uses the approved registration mode (details only, native website form, or approved external link).
- [ ] Existing native registration counts were verified after the v9 table migration.
- [ ] PWA manifest/service worker install without console errors.
- [ ] REST directory and approved client integrations are tested.
- [ ] Approved app/client login, token expiry and logout/revocation are tested.
- [ ] WordPress sitemap loads and has been submitted to official webmaster properties.
- [ ] CSV imports are tested with a valid export/template and rejected malformed files are handled safely.
- [ ] Staging has been tested for 404s and redirect needs after the v9 URL architecture change.

## Content and ministry

- [ ] Hero statement and calls to action are approved.
- [ ] Current national leadership information is correct.
- [ ] All published Region/Area contact details are verified.
- [ ] Impact figures are current and authorised.
- [ ] Old/expired events are removed or correctly dated.
- [ ] Bible resource links are current.
- [ ] Stories/testimonies are accurate and consent-cleared.
- [ ] No placeholder or developer-only language is visible publicly.

## Safeguarding, privacy and media

- [ ] Public Safeguarding page has been reviewed by the authorised SU safeguarding authority.
- [ ] Public Privacy page has been reviewed against actual data practices and applicable requirements.
- [ ] Photo/video/testimony consent procedures are approved.
- [ ] Child/youth forms collect only necessary data.
- [ ] No private worker or participant data is exposed publicly without authorisation.
- [ ] Media entries use internal consent references where appropriate.

## Access and security

- [ ] Every administrator has an individual named account.
- [ ] Unused administrator accounts are removed or downgraded.
- [ ] Regional/Area users have the correct scope assigned.
- [ ] 2FA is enabled for privileged users at the hosting/security layer or approved WordPress security layer.
- [ ] Firewall and malware monitoring are active.
- [ ] Automated off-site backups are active.
- [ ] A restore test has been completed.
- [ ] Production secrets/API credentials are not present in page content or public source code.

## Finance and communications

- [ ] Every giving link and bank detail has Finance approval.
- [ ] Transactional/contact email delivery is tested to multiple providers.
- [ ] Official national email, phone and address are correct.
- [ ] WhatsApp links use an approved organisational number where enabled.

## Performance and accessibility

- [ ] Test low-end Android and slow-network behaviour.
- [ ] Test desktop and mobile Core Web Vitals/Lighthouse on staging.
- [ ] Keyboard navigation works for header/menu/search/forms.
- [ ] Text contrast and focus states are acceptable.
- [ ] Images are compressed and meaningful images have suitable alternative text.
- [ ] No unnecessary autoplay media is introduced.

## Final governance approval

- [ ] National Management/authorised leadership approves production cutover.
- [ ] Website Coordinator has a documented rollback procedure.
- [ ] Responsible Departmental Content Liaisons are identified.
- [ ] A monthly content freshness review and quarterly access/security review are scheduled.