Does Launch Auditor work on WordPress.com and self-hosted WordPress?
Yes. Scan your public site URL. Launch Auditor checks headers, pages, performance, and trust signals regardless of hosting — it does not require wp-admin access.
All launch resources
WordPress launch checklist
WordPress site going live?
Plugins, themes, and wp-admin defaults create a unique risk profile — exposed xmlrpc, missing security headers from shared hosting, duplicate meta from SEO plugins, and slow LCP from unoptimized media.
Supabase backend testing (optional)
Provide Supabase credentials to run deeper RLS and cross-tenant isolation probes. Secrets are encrypted at rest and never appear in scan reports.
Expand to add optional Supabase credentials.
Security & headers
Production deploys need baseline HTTP hardening before you share the URL.
Confirm HSTS is enabled — many WordPress hosts omit it unless you configure at CDN level.
Audit check SEC-001 · security
Block or rate-limit xmlrpc.php if you don't need remote publishing.
Audit check SEC-015 · security
Verify wp-config.php and .env backups are not web-accessible.
Audit check SEC-010 · security
Check TLS certificate validity and chain — shared hosting renewals fail silently.
Audit check DNS-001 · dns ssl
SEO & discoverability
Metadata, crawlability, and structured data that search and AI systems rely on.
Resolve duplicate title tags from Yoast/RankMath on archive and tag pages.
Audit check SEO-002 · seo
Ensure sitemap.xml is reachable and not blocked by a security plugin.
Audit check SEO-010 · seo
Set canonical URLs on paginated blog and product listing pages.
Audit check SEO-011 · seo
Performance
Core Web Vitals and load behavior under real traffic — not just localhost.
Optimize hero and featured images — WordPress uploads often ship uncompressed.
Audit check PERF-001 · performance
Trust & legal
Policy pages, contact signals, and checkout trust before paid or viral traffic.
Privacy Policy and Terms pages must be linked in footer and return 200 — not draft status.
Audit check TRUST-001 · trust
Contact page or support email visible for commerce and lead-gen sites.
Audit check TRUST-003 · trust
FAQ
WordPress launch questions
Audit your WordPress site
Supabase backend testing (optional)
Provide Supabase credentials to run deeper RLS and cross-tenant isolation probes. Secrets are encrypted at rest and never appear in scan reports.
Expand to add optional Supabase credentials.
Free tier · No credit card · Create account