My static site is on Vercel/Netlify/Cloudflare Pages — do I still need this checklist?

Yes, for the parts the host doesn't handle. Vercel and Cloudflare give you HTTPS, a CDN, and automatic builds for free. But security headers (CSP, HSTS, X-Frame-Options), accessibility, cookie consent, and a privacy policy are still your responsibility. The checklist flags which items your host likely already covers.

What's the minimum to ship a static site responsibly?

Four things: HTTPS (free, automatic on modern hosts), security headers (a few lines of config — see our security headers guide), WCAG 2.1 AA basics (semantic HTML, alt text, color contrast), and a privacy policy + cookie banner if you use any third-party scripts. That's it. The rest of the 18 items are refinements.

Do I need rate limiting on a static site?

Generally no — there's no backend to rate-limit. Your CDN handles traffic spikes automatically. The exception is if you have a contact form or API endpoint; those need rate limiting regardless of whether the rest of the site is static.

~18 checks · 4 critical sections

Production Readiness Checklist for Static & Marketing Sites

Free production readiness checklist for static sites and marketing pages — security headers, CDN, accessibility, cookie consent & more. Only ~18 checks. No signup.

Start the checklist Jump to critical sections

Free · no signup
18 checks
Export MD / JSON / PDF
Saves to your browser

A static site — a marketing page, blog, docs, or landing page — doesn't need distributed tracing or chaos engineering. But it still has real production requirements: HTTPS with the right security headers, a CDN so it loads fast globally, accessibility so every visitor can use it, and a cookie consent banner if you show ads or analytics.

This checklist filters the full 92-item framework down to the ~18 checks that genuinely matter for a static or marketing site. It's intentionally short — don't pad it. Get these right and your site is fast, safe, accessible, and compliant.

If you're running ads (AdSense, Ezoic, etc.), the Data & Compliance section's cookie consent item is non-negotiable — EU/UK traffic requires it, and Google will reject your AdSense application without a privacy policy and consent banner.