The Complete Custom Website Checklist: E-commerce Websites (SEO + Security)

E-commerce sites carry the highest stakes of any site type on this list — real payment data, real inventory, and typically the largest, most duplicate-content-prone URL footprint of any custom build. A gap here doesn't just cost rankings; it can cost a breach or a compliance violation. This checklist covers the full scope, from product-level SEO to payment security.

Pre-Launch Technical Foundations

[ ] XML sitemap is segmented logically (products, categories, static pages) rather than one enormous file
[ ] Robots.txt correctly manages crawl access to filter and parameter-based URLs
[ ] Canonical tags are set correctly on every product and category page, including filtered variants
[ ] HTTPS is enforced site-wide, with particular attention to the entire checkout flow
[ ] URL structure for products and categories is clean, descriptive, and stable
[ ] 404 and out-of-stock handling return correct status codes rather than a generic soft error

> Tool tip: Run the SEO Audit tool early, since ecommerce sites tend to have far more technical surface area than other site types and issues compound quickly as the catalog grows.

Product Page SEO

[ ] Every product has a unique title tag and meta description, not an auto-generated duplicate of the product name alone
[ ] Original product descriptions are used where possible, rather than unedited manufacturer copy shared across every retailer
[ ] Product schema markup (price, availability, reviews) is implemented and validates correctly
[ ] Every product image has descriptive, accurate alt text
[ ] Breadcrumb navigation and matching breadcrumb schema are present on every product page
[ ] Product variants (size, color) are handled with proper canonicalization to avoid duplicate content

> Tool tip: Check the Meta Tags Analyzer across a sample of product pages to catch templated, duplicate metadata before it spreads across the full catalog.

Category & Faceted Navigation SEO

[ ] Category pages include genuine introductory content, not just a bare product grid
[ ] Filter and sort combinations are canonicalized back to the primary category page where they don't warrant independent indexing
[ ] A deliberate decision has been made about which filter combinations, if any, deserve their own indexable, optimized page
[ ] Faceted navigation doesn't generate infinite or near-infinite crawlable URL combinations
[ ] Pagination across category listings is handled cleanly, without creating thin, near-duplicate pages

> Tool tip: Use the Keyword Cannibalization Checker to catch category and filter pages unintentionally competing against each other for the same terms.

Out-of-Stock & Discontinued Product Handling

[ ] Out-of-stock products remain live with clear messaging when the product will return, rather than being deleted outright
[ ] Permanently discontinued products are 301 redirected to the closest current equivalent, not left as dead links
[ ] Out-of-stock pages offer a relevant in-stock alternative rather than a dead end
[ ] Structured data availability status is kept accurate and current

Payment & Checkout Security

[ ] Payment processing runs through a PCI DSS–compliant provider or gateway
[ ] Raw card data never touches or is stored on your own servers unless you have full, current PCI DSS certification to do so
[ ] The entire checkout flow, from cart to confirmation, is served over HTTPS with no mixed content
[ ] Checkout forms are protected against automated bot and card-testing fraud attempts
[ ] Session handling during checkout prevents cart or account hijacking
[ ] Order confirmation and receipt pages don't expose sensitive customer or payment data in the URL

> Tool tip: Confirm your checkout domain's DNS and mail authentication setup with Find DNS Records as part of a broader review, particularly if order confirmation emails are involved.

Customer Data & Privacy Security

[ ] Customer accounts require strong password practices, with hashing that follows current standards
[ ] Customer order history and personal data are accessible only to the account owner and properly authorized staff
[ ] A documented process exists for handling data deletion or export requests
[ ] Guest checkout data is handled with the same security standard as registered account data
[ ] Third-party integrations (email marketing, fulfillment, analytics) are audited for what customer data they actually receive

General Site Security

[ ] CMS, plugins, and any custom code dependencies are kept current with security patches
[ ] Admin and staff accounts use two-factor authentication
[ ] Automated, tested backups run regularly and are stored securely off-server
[ ] Security headers are configured: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options
[ ] File upload functionality (product images, review attachments) is restricted and scanned appropriately
[ ] Inventory and pricing data can't be manipulated through client-side request tampering

> Tool tip: Run periodic Google Malware Checker and Blacklist Lookup scans, since a compromised ecommerce site is a particularly attractive target and the financial and reputational cost of a missed breach is high.

Reviews, Trust Signals & Fraud Prevention

[ ] Product reviews use structured data markup and reflect genuine, verifiable customer feedback
[ ] Review submission is protected against spam and fake review injection
[ ] Basic fraud detection is in place for unusually large or suspicious orders
[ ] Trust signals (security badges, clear return policy, visible contact information) are present near the point of purchase

Legal & Policy Pages

[ ] Shipping policy is clear, accurate, and easy to find
[ ] Returns and refund policy is clearly stated before checkout, not buried
[ ] Privacy policy accurately reflects actual customer data collection and use
[ ] Terms of service and any applicable sales terms are published and current
[ ] Sales tax calculation is accurate for every jurisdiction you legally need to collect in

Product Feed & Shopping Ads Readiness

[ ] A product feed is available and correctly formatted for shopping ad platforms, if used
[ ] Feed data (price, availability, images) stays synced with the live site in near real time
[ ] Product titles in the feed reflect how shoppers actually search, not just an internal SKU naming convention

Performance

[ ] Product and category pages are tested for Core Web Vitals, not just the homepage
[ ] Product images are optimized and appropriately sized rather than served at full original resolution
[ ] Checkout flow performance is tested specifically, since a slow checkout directly costs completed sales

> Tool tip: Check the Page Size Checker on a representative product page, since ecommerce templates often accumulate significant image and script weight over time.

Analytics & Tracking

[ ] Ecommerce tracking is implemented and verified, capturing product views, cart additions, and completed purchases
[ ] Search Console is verified with an accurate, current sitemap submitted
[ ] Internal site search is tracked to reveal genuine product demand and inventory gaps
[ ] Abandoned cart events are tracked to inform recovery efforts

Post-Launch Monitoring

[ ] A recurring schedule exists for reviewing Search Console indexing and manual action status
[ ] Broken link and redirect checks run regularly as the catalog changes over time
[ ] Discontinued and out-of-stock product handling is periodically audited for accuracy
[ ] Security scans and dependency checks run on an ongoing basis, not just at launch

Next step: Run the SEO Audit tool as a recurring part of your maintenance routine, not just at launch — an ecommerce catalog changes constantly, and each new product or category is a fresh opportunity for something on this list to quietly slip.