# 09 LAUNCH RUNBOOK Staging subdomain to live domain on Namecheap shared hosting. Do not reorder these steps. --- ## Before the day - Lower TTL on the existing DNS records to 300 seconds, 24 hours before the switch, so a rollback is fast. - Full backup of staging, verified restorable, not just taken. - Confirm staging is still `noindex`, that its `robots.txt` disallows everything, and that it is password protected at the cPanel level so it never gets indexed. - Complete the QA test plan. Every item. ## 1. Freeze No code changes for 24 hours before cutover. ## 2. Point the domain Set the Namecheap domain nameservers to the host, or set A records to the shared IP plus a CNAME for `www`. If Cloudflare is going in front (decision D-22), point the nameservers at Cloudflare instead and create the A and CNAME records there. **Whichever you choose, that is where every DNS record in step 9 goes too.** Write down which one you picked. ## 3. Move the site Copy `public_html` from the staging subdomain to the live document root. Export and import the database. Run a URL search and replace: ``` wp search-replace 'https://staging.DOMAIN' 'https://DOMAIN' --all-tables --precise ``` or Better Search Replace if WP-CLI is not available. **Never do a plain SQL find and replace.** It corrupts serialised data and the damage is not obvious for weeks. ## 4. SSL Issue AutoSSL or Let's Encrypt in cPanel for both `DOMAIN` and `www.DOMAIN`. Wait for validation. Do not proceed on a self-signed certificate. Then force HTTPS in `.htaccess` and pick one canonical host, `www` or non-`www`, and 301 the other. Pick one and never change it later. ## 5. Update wp-config.php Set `WP_HOME` and `WP_SITEURL` to the live HTTPS URL. `FORCE_SSL_ADMIN` true. Production database credentials. Regenerate the salts, which logs everyone out, which is exactly what you want. ## 6. Search engine visibility ON Settings, Reading, uncheck "Discourage search engines". Then verify `/robots.txt` no longer contains `Disallow: /` and that no `noindex` header is being sent. **This step is forgotten more often than any other on this list.** Check it twice. ## 7. Permalinks Save permalinks twice to flush rewrite rules. Spot check ten product URLs, five category URLs, plus cart, checkout, my-account and track-order. The stripped category base is the most common source of silent 404s in WooCommerce, so this check is not optional. ## 8. Cron ``` */5 * * * * cd /home/USER/public_html && /usr/local/bin/php wp-cron.php >/dev/null 2>&1 ``` Verify scheduled WooCommerce events are firing. ## 9. Email deliverability This will break by default, because PHP mail from a shared IP goes to spam. Do all of it: 1. Create `orders@DOMAIN` in cPanel. 2. **Decide where DNS is authoritative first.** If Cloudflare is in front (decision D-22), every record below goes in Cloudflare, not the Namecheap panel. Putting them in the wrong place is the most common reason this step appears done and is not. 3. Add SPF **for the relay, not the web host**, because that is where order mail actually originates. Brevo: `v=spf1 include:spf.brevo.com ~all`. Amazon SES: `v=spf1 include:amazonses.com ~all`. If transactional mail goes through the relay and cPanel also sends some mail, include both. An SPF record naming only `spf.web-hosting.com` fails SPF on every order email, which is exactly the problem this step exists to prevent. 4. Add DKIM **from the relay**. Brevo and SES each publish their own CNAME or TXT records in their dashboard. cPanel's own DKIM key signs mail sent by cPanel, not mail sent by the relay, so publishing only that one leaves relayed mail unsigned. 5. Add DMARC: `v=DMARC1; p=none; rua=mailto:dmarc@DOMAIN` 6. Configure WP Mail SMTP with a relay. Brevo (300 free emails a day, works well from Pakistan) or Amazon SES if volume grows. From name is the brand, from address is `orders@DOMAIN`, sender verified in the relay. 7. Send test order emails to Gmail, Outlook and a Pakistani ISP address. Check the spam folder in each, and check the SPF and DKIM results in the message headers, not just where it landed. ## 10. Cache Purge LiteSpeed completely. Re-enable page caching for the live domain. Warm the top 100 URLs with the cron script from phase 13. **The LiteSpeed crawler is disabled at server level on Namecheap shared plans**, so do not wait for it. ## 11. Analytics and search - Swap the staging GA4 property and Meta Pixel to production IDs, verify in DebugView - Verify the domain in Search Console and Bing, submit the sitemap - Verify the domain in Meta Business Manager, upload the catalogue feed - Confirm the Merchant Center feed URL is publicly fetchable ## 12. Security final pass Change every password. Remove staging admin accounts. Delete unused themes and plugins. Confirm `wp-config.php` is 600, the file editor is disabled, and 2FA is on for every admin. ## 13. Post-launch smoke test, 20 minutes, live Run this on mobile data, not wifi. 1. Homepage 2. Category page 3. Product page 4. Add to cart 5. Checkout as a guest with a real Pakistani phone number 6. Place a real COD order for the cheapest product Then confirm: the order appears in admin within seconds, the customer email arrives in the inbox, the admin email arrives, GA4 realtime shows the purchase with the correct PKR value, and Meta Events Manager shows Purchase once with the Conversions API event deduplicated. Move that order through to Delivered, then cancel or refund it. Check `/robots.txt`, the sitemap, and one product URL in the Rich Results Test. Run PageSpeed Insights on the homepage and one product page. Record the numbers as the launch baseline. ## 14. Watch, 72 hours - Check the order list twice daily - Watch Search Console coverage for unexpected `noindex` or 404 spikes - Watch the cPanel resource usage graph for CPU or entry-process throttling under ad traffic --- ## Launch checklist, condensed Do not declare the project complete until all of these are true. - [ ] Domain resolves, HTTPS works, one canonical host - [ ] WordPress and WooCommerce configured - [ ] Products, categories, attributes and variations all work - [ ] Search works - [ ] Filters work and are `noindex, follow` - [ ] Cart works - [ ] Guest checkout works - [ ] COD works end to end - [ ] Payment gateway slot exists and is documented, even though nothing is connected - [ ] Order emails arrive in the inbox - [ ] Admin order management works, including verification, fulfilment, courier and COD - [ ] Settlement recording works - [ ] Track Order page works - [ ] GA4 installed and firing - [ ] Meta Pixel installed and firing, Conversions API purchase deduplicating - [ ] SEO configured, schema valid - [ ] Sitemap submitted - [ ] Mobile tested at 360, 390 and 430 - [ ] Desktop tested at 768, 1024 and 1440 - [ ] Security hardening applied - [ ] Backups running, and a restore actually tested - [ ] Every footer and drawer link resolves, no dead pages - [ ] Size Guide and Returns pages carry real content, not placeholders - [ ] Product feed accepted by Merchant Center - [ ] Performance within budget, baseline recorded