The pre-handoff checklist.

Copy

• No spelling or grammar errors, and your own product and brand names written the same way every time.
• No placeholder text, stray markdown, or sentences that stop mid-thought.
• No claim without a number, a name or a date behind it. “Trusted by thousands” is not a claim.
• None of the words a model reaches for when it has nothing to say: seamless, robust, elevate, unlock, leverage, cutting-edge.
• A competitor could not put their logo on the page and keep every word.

SEO and answer engines

• Exactly one h1, and no skipped heading levels.
• A title under about 60 characters that leads with what the page is for.
• A meta description of 120 to 160 characters, written to earn the click.
• Canonical, robots and html lang present, and no noindex on a page meant to rank.
• Structured data that fits the page: Organization or LocalBusiness, Service, Product, FAQPage.
• One sentence near the top an assistant could quote: who it is for, what it sells, and where.

UX and accessibility

• Body text at 4.5:1 contrast or better, large text at 3:1.
• Tap targets at least 44 by 44 pixels.
• Every form field has a label.
• Every image has alt text, or alt="" when it is decorative.
• No link that only says “click here” or “read more”.
• The main action is named as an action and appears early on the page.

Speed

• No image served far larger than it is shown. The lens flags anything over 1.75 times its displayed size.
• The heaviest files on the page are ones you meant to ship.
• Nothing blocks the first render that does not need to.

Legal

A screening list, not legal advice.

• A privacy policy that is linked, loads, and has no template placeholders left in it.
• A privacy link at every form that collects personal data.
• No tracking script or cookie before the visitor agrees, wherever you have visitors in the EU or UK.
• A consent manager wherever advertising pixels run.
• Marketing opt-in as its own unticked box, never bundled into the submit button.
• A legal business name, a postal address and a way to reach you.

Security

An external screen, not a pentest.

• No secret key in the page or its inline scripts. Publishable keys meant for the browser are fine.
• Every form posts over https.
• Nothing loaded over http on an https page.
• Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy headers in place.