By Dean O'Meara · Founder, Wrapt
Launching a startup is equal parts exciting and terrifying. Miss one critical step and you could be dealing with legal headaches, security breaches, or a launch day that falls flat. This checklist covers 30 concrete items across six categories — everything from business registration to your go-live strategy. Work through them in order, check each one off, and you'll launch with confidence instead of crossed fingers.
1. Register your business entity. Choose the right structure (LLC, C-Corp, etc.) and register in your jurisdiction. If you're planning to raise venture capital, a Delaware C-Corp is the standard.
2. Secure your domain name and trademark. Buy your primary domain plus common misspellings. File a trademark application early — it can take months to process and you don't want someone else claiming your name.
3. Draft your Terms of Service and Privacy Policy. These are non-negotiable before launch. Use a reputable legal template or hire a startup lawyer. Make sure your Privacy Policy covers data collection, cookies, and third-party services you integrate with.
4. Set up a business bank account and accounting. Keep personal and business finances separate from day one. Connect a tool like QuickBooks or Xero so you're not scrambling at tax time.
5. Get the right insurance. General liability and professional liability (errors & omissions) coverage protects you if something goes wrong. Many enterprise clients will require proof of insurance before signing a contract.
6. Ship a working MVP, not a perfect product. Your launch version needs to solve the core problem reliably. Cut everything else. You can iterate after real users give you feedback.
7. Set up CI/CD pipelines. Automate your build, test, and deployment process with GitHub Actions, GitLab CI, or similar. Manual deployments introduce human error and slow you down when you need to ship fixes fast.
8. Configure staging and production environments. Never test in production. Have a staging environment that mirrors your production setup so you can catch issues before they reach users.
9. Set up database backups and test restores. Automated daily backups are the minimum. But a backup you've never restored is a backup you can't trust. Run a test restore before launch day.
10. Load test your infrastructure. Use a tool like k6 or Artillery to simulate traffic spikes. Know your breaking point before your users find it for you on launch day.
11. Enforce HTTPS everywhere. There is no excuse for serving any page over plain HTTP. Configure your SSL/TLS certificates and set up automatic renewal. Redirect all HTTP traffic to HTTPS.
12. Implement authentication and authorization properly. Use a proven auth library or service — don't roll your own. Enforce strong password policies or use passwordless auth like magic links. Check out our glossary for definitions of common auth terms like OAuth, JWT, and RBAC.
13. Set up rate limiting and DDoS protection. Put your app behind Cloudflare or a similar service. Implement API rate limiting to prevent abuse. Bots will find your endpoints faster than you think.
14. Run a security audit on dependencies. Use npm audit, Snyk, or Dependabot to scan for known vulnerabilities in your packages. Fix critical and high-severity issues before launch.
15. Set up secrets management. Never commit API keys, database credentials, or tokens to your repository. Use environment variables and a secrets manager. Rotate any keys that were ever exposed in version control.
16. Build a landing page that converts. Your homepage has about five seconds to communicate what you do and why someone should care. Lead with the problem, show the solution, and include a clear call to action above the fold.
17. Set up email infrastructure. Configure SPF, DKIM, and DMARC records for your domain. Use a transactional email service like Postmark or Resend for receipts and notifications. Bad email deliverability kills onboarding.
18. List on startup directories. Submit your startup to directories where founders and early adopters discover new products. You can submit your startup to Wrapt to get in front of a community that votes on and reviews real companies. Being listed early builds backlinks and social proof.
19. Prepare your social media profiles. Claim your handle on X/Twitter, LinkedIn, and any platform relevant to your audience. Fill out bios, add your logo, and post a few pieces of content before launch so your profiles don't look empty.
20. Write a launch announcement. Draft a blog post, email to your waitlist, and social media posts in advance. Don't improvise on launch day. If you're new to this, our getting started guide walks through the basics of building your online presence.
21. Install web analytics. Set up a privacy-friendly analytics tool like Plausible, Fathom, or PostHog. Know where your traffic comes from, which pages people visit, and where they drop off.
22. Set up error monitoring with Sentry or similar. You need to know about errors before your users report them. Configure source maps so stack traces point to your actual code, not minified bundles.
23. Configure uptime monitoring. Use a service like BetterUptime, UptimeRobot, or Checkly to ping your endpoints every minute. Set up alerts via Slack, email, or SMS so you know immediately when something goes down.
24. Set up log aggregation. Centralize your application logs with a tool like Datadog, Logtail, or the ELK stack. When something breaks at 2 AM, you need to be able to search logs quickly, not SSH into individual servers.
25. Define your key metrics. Pick 3-5 metrics that matter most for your business — signups, activation rate, retention, revenue, or whatever maps to your model. Build a dashboard you check daily. If you don't measure it, you can't improve it.
26. Do a full end-to-end test. Walk through every critical user flow — signup, onboarding, core action, payment (if applicable), and logout. Do it on desktop and mobile. Do it in Chrome, Safari, and Firefox. Fix anything that breaks.
27. Prepare a rollback plan. Know exactly how to revert to the last stable version if something catastrophic happens. Document the steps. A five-minute rollback is infinitely better than a two-hour panic fix.
28. Brief your team on the launch plan. Everyone should know their role — who's monitoring social media, who's watching error logs, who's handling support tickets. Even if your team is just two people, write it down.
29. Stagger your announcements. Don't blast every channel at once. Start with your warmest audience (waitlist, existing users), then expand to social media, then directories and communities. This lets you catch issues at low traffic before the flood.
30. Ship it and start listening. Launch is the beginning, not the end. Pay attention to what users do, not just what they say. The first 48 hours of real usage will teach you more than months of building in isolation.