Reviewing launch checklist for the guide

[vossisboss]

Hi All:

I've taken the launch checklist and this is my first pass at revising it for this specific project. Please let me know if anything is missing or needs to be added or revised. @kaedroho and @thibaudcolas, I'm not sure which tech pieces we want or don't want. For example, will this site need Cloudfare? Sentry? Debugbear? Not sure which pieces we need and which we don't.

Thanks!

Pre-launch tasks

Content

• Finalise initial launch content
• Check that all test content and test user accounts are deleted
• Check that all existing user accounts are using strong passwords
• Update the title tags in the “Page title” field of the “Promote” tab as per SEO guidance for initial launch content
• Update meta descriptions in the Promote tab for initial launch content
• Ask Ben to create sharing image logo for social media sharing

Project management tasks

• Determine what the URL will be
• Register the URL (if not registered already)
• Agree on launch date and timeline
• Define a set of critical workflows to test site pre- and post-launch
• Check hosting costs have been accounted for (over-resource on launch, reduce later)
• Write and agree upon tech steps for launch plan. The plan should literally write out what happens in the order it will happen.

Testing tasks

• Check all footer links work
• Test sharing of all types of pages
• Check site search is working (including results looking reasonable, faceted searches working, results totals look right)
• Check there are no hard-coded links to the staging URL
• Confirm all test content is deleted
• Test redirects
• Test end-to-end all critical workflows pre- and post-launch

Front-end tasks

• Request a site-wide accessibility audit from another front-end developer
• Check fonts are set up to work on live domain and set up if not
• Check favicon (check that a request direct to /favicon.ico serves up the icon regardless of where the image is actually stored.)
• Check title tags and meta descriptions
• Check all of the templates use the correct lang for the site’s intended audience (en-US, en-GB, or something else entirely)
• Check social media sharing, twitter cards, facebook open graph
• Check that the CSS and JS deployed to production has been minified by the front-end toolchain.
• Check the site’s pages in Lighthouse, and report any issues

Backend tasks

• Security Review: Ensure each section from has been reviewed using security best practices and you are confident with the site's security standards.
• Documentation review: Is everything important documented?
• Documentation review: Ensure there are no secret/sensitive values in the documentation (if public)
• Documentation review: Ensure the documentation is viewable over gitlab/github pages.
• Check FE caching is set up
• Ensure the production site allows indexing by setting the environment variable SEO_NOINDEX=False. This will add the meta tag.
• Ensure dev and staging environments are not being indexed by confirming the existence of the in the rendered HTML.
• Test that emails are sent (with correct from address and subject line prefixes) for form submissions (custom forms, password reset etc).
• Change hostname in the settings-sites-site to the production url
• Confirm production settings are in use
• Update allowed hosts
• Application logs are configured and being written to
• Check scheduled tasks have been set up and are functioning correctly (e.g. publish_scheduled_pages)
• Set up Mailgun for sending of email notifications (if not Mailgun: document alternative email service on client intranet article and who is responsible for admin).
• Set up Sentry
• Test 500 Error exception Sentry logging / Admin emailing
• Set up Papertrail
• Set up Scout
• Set up DebugBear
• Confirm SSL config is rated A+ on SSL Labs and security headers are rated A on Security Headers IO
• Check that all Django admin user accounts are using strong passwords (and optionally using 2FA) or are disabled [we can't check users' passwords, only if the default strong password validator has been changed]
• Double check Mailgun setup from django.conf import settings; from django.core.mail import send_mail; send_mail('test', 'test', settings.DEFAULT_FROM_EMAIL, ['...@torchbox.com'], fail_silently=False)
• Change email links from production url to live url at launch (emails should use the wagtail site record instead, so only that should be set correctly)
• Test sitemap.xml
• Test robots.txt is present and contains appropriate rules
• Ensure title tags are set as ‘ | Homepage Keyword’ for the homepage and ‘Other Pages | ’ for all other pages, where the “Homepage Keyword” part should come from the “Page title” field in the “Promote” tab.
• Create Heroku and Cloudflare error pages - sysadmin will add to Cloudflare when the pages are ready
• If using reCAPTCHA, check / configure threshold

Sysadmin tasks

• Check non-www - redirects to www
• Check the canonical domain is unchanged (if originally www, new site should be www)
• Check the TTL on the DNS is low enough for timely propagation (only if nameservers not CloudFlare)
• Check email-related DNS records (SPF, DKIM).
• Check that backups are functioning correctly and that the restore process works (Heroku)
• Check file uploads are backed up (confirm AWS S3 set to versioned mode)
• Basic HTTPS uptime monitoring via Prometheus
• Heroku failed request threshold alert (Sysadmin or Tech)
• Check web server logs are configured and being written to (Heroku)
• Setup scripted Heroku scaling; or ticket TBC as pre-launch task.
• Check Redis maxmemory policy
• Enable Cloudflare Web Application Firewall
• Add site name to Heroku timeout restart tool
• Check the performance characteristics of the app (e.g. is memory and CPU load within bounds on Heroku metrics).
• Check Heroku add-on resources for anything non-standard (e.g., there may be a service on a free plan that will need to be upgraded on launch).
• Add Cloudflare or Cloudfront environment variables for front-end invalidation
• f using Cloudlfare, check that Polish is enabled.
• Check and ensure Sentry filters out sensitive fields (Project > Settings > Security & Privacy > Additional Sensitive Fields)
• Check that tracking query parameters from any marketing tools the client is planning to use are added to those that stripped out by the worker (if using Cloudflare - STRIP_QUERYSTRING_KEYS)
• Block Outlook's autodiscover requests
• Is ./manage.py check --deploy running without issue? Is this command added to release phase commands?

Launch day tasks

Backend tasks

• Check production domains are set in Heroku "Settings / Domains and certificates
• Check production domains caching has been configured in CloudFlare page rules
• Prepare to change DNS via CloudFlare to point at Heroku backend hostnames (check understanding change to be made at launch).
• Check ALLOWED_HOSTS and PRIMARY_HOST include production domain in Heroku "Settings / Config Vars"
• Remove htauth from production domain (leave htauth on for herokuapp.com domain by using BASIC_AUTH_WHITELISTED_HTTP_HOSTS
• Change DNS for canonical domain to point at Heroku (via CloudFlare)
• Generate SSL certificates and force SSL (dependent on DNS propagation) (Cloudflare/Cloudfront)
• Check Heroku dyno memory usage vs. number of workers

Marketing checks

• Ensure GTM container is tracking correctly on production site.
• Verify site via Google Search Console

Post-Launch Tasks

• Check Sentry error rates 24/48 hours after launch
• Check project performance scores in DebugBear 24/48 hours after launch
• If using reCAPTCHA, review behaviour and reconfigure threshold if necessary

[lb-]

Wow. What a list - this is incredible.

A few additional thoughts / questions.

• are we using a sub-domain ? (e.g. guide.wagtail.org)?
• post launch (or depending on the guide being ready when 4.0 goes out) - remove the user guide content from docs and have that section show a link to the new guide site. This on the Wagtail repo.
• can we consider a more privacy focused analytics approach? Maybe server side only, but no cookies at a minimum. Or maybe the GTM is just for search console addiction?
• other search engines - DuckDuckGo / Bing - do they need any specific engagement
• would be good to reach out the the translator community on Slack once we are ready to ask for contributions. Also maybe a comment on any Wagtail 'docs should be translated' discussions or issues.
• will there be a preview/ beta phase - would be great to get early feedback from.the community in Slack / maybe even on the relevant GitHub discussion. Even if there is no feedback - it helps to keep people in the loop.

[thibaudcolas]

• I suspect this will be a subdomain but I don’t think we’ve fully confirmed this yet.
• Have opened Replace docs site pages with new site #91 and Redirects from docs site pages to new site #92 for us to replace the existing content with our link, and create redirects.
• Analytics: Analytics setup with Plausible #103
• Guidance on how to translate to a new language #67
• I’ll share info in Slack now

[thibaudcolas]

@vossisboss list is looking good to me, I had crossed off a few items initially, but they were all relatively minor, felt like the people going through this could tick this off themselves.

On the hosting – I would say we should get the whole shebang yes.

On the analytics, I believe we’ve used Plausible for the docs, and yeah wouldn’t want to use GTM / Google Analytics as LB mentions.

One other thing I’d follow up on sooner rather than later is SEO – since we already have content that this will replace, and the site with that content has a finicky setup.

[vossisboss]

@thibaudcolas By SEO, do you mean we should get analysis from the SEO team? If it's keyword research, that's something I can do or contribute to. If we need more, I think our SEO resources are booked for a while.

FYI to all, I've started a ticket in Codebase for our hosting environment so that we can get some help from sysadmin on that. @kaedroho got busy with the release and couldn't fit it in.

[thibaudcolas]

Yes, I’m surprised not to see much SEO on the checklist. In particular I’d expect them to be involved with:

• High-level auditing of the new (& existing) content, to make sure we’re performing well on the types of searches that are currently going to docs.wagtail.org
• QA for SEO aspects of the new build (page metadata primarily)
• Redirects planning – look at all the URLs of the existing content and help us determine where to redirect them to
• Monitoring of the content’s SERP rankings before / after launch

[thibaudcolas]

I’ve added the updated checklist items in three issues: #100, #101, #102. Please update the lists directly as needed, or comment on there to make suggestions.

[thibaudcolas]

For anyone following this – here is the final™ launch plan, with links to all issues deemed critical for launch: #136.