What counts as a web application for this checklist?

Any user-facing application delivered through a browser — a React/Vue/Svelte SPA, a Next.js/Remix SSR app, a Rails/Django/Laravel monolith with server-rendered templates, or an Eleventy site with a small backend. If users log in, submit forms, or read dynamic data in a browser, it's a web app.

What's the most important section for a web app?

Security and Auth together. A web app with weak input validation, missing security headers, or insecure session handling is trivially exploitable. After those, Performance (caching, CDN, indexing) and Accessibility (WCAG 2.1 AA) are the next highest-leverage areas — the first affects every user, the second is often legally required.

Do I need all 60 checks on day one?

No. The items marked 'critical' for web apps are the non-negotiables: HTTPS, input sanitization, auth done right, security headers, rate limiting, error handling, and backups. Get those done, ship, then work through the rest. An unshipped perfect checklist helps no one.

~60 checks · 7 critical sections

Production Readiness Checklist for Web Applications

Free production readiness checklist for web applications — security, auth, performance, accessibility & more. Filtered to what web apps actually need. No signup.

Start the checklist Jump to critical sections

Free · no signup
77 checks
Export MD / JSON / PDF
Saves to your browser

Shipping a web application to production means getting a lot right at once: authentication that resists brute force, security headers that shut down XSS, a database that won't fall over under real traffic, accessibility that works for every user, and observability that tells you when something breaks.

This checklist filters the full 92-item production readiness framework down to the ~60 checks that genuinely matter for a web app (SPA or SSR). Work through it before launch, mark items done or blocked, add notes linking to your runbooks, and export the result as an artifact for your launch doc.

The web-app path skips SaaS-only concerns like multi-tenancy and payment fraud — those belong in the full SaaS checklist. What's here is the 80/20 for shipping a web application safely.