An agency preflight checklist that is not theater

I have sat on calls where the preflight deck had twelve green screenshots and zero live evidence. Theater. The checklist that survives launch week is shorter and meaner: permission on the exact production URL, ranked findings with evidence, owners for anything still open, and a rescan after the last fix.

SlaySlop is built for that shape of work: free read-only scan for security, SEO, and performance, then keep scanning for new issues, with 24/7 uptime checks on paid plans. Reports and portals exist so you can share scoped views without dumping the whole workspace on the client.

Outcome

You want a go/no-go note that names remaining risks with URLs, not a vibe. Categories on the checks catalog span Security, SEO and AEO, Performance, Accessibility, Legal, UX, and Domain and infrastructure. You do not need every row green to ship. You need eyes open.

Boundaries

Permission required. Read-only. Not a pentest. Do not scan the client's competitor "for benchmarking" without authorization. Do not promise a SlaySlop pass as a WCAG certificate or a SOC report. Soft honesty on the call beats a theatrical checklist.

Happy path checklist I actually use

1. Confirm the hostname the client will advertise. Scan that, not an old Netlify preview.
2. Security starter: CSP, HSTS, frame protection evidence. Then Client-side secrets. Then TLS/SSL rows if red.
3. SEO and AEO: titles, descriptions, robots, sitemap, structured data, answer-engine readiness on key routes.
4. Performance and accessibility: viewport configuration, accessible names on primary controls, spot the worst LCP/CLS/interaction issues.
5. UX: console errors and failed requests after render.
6. Domain: redirect chain from the advertised entry URL, availability status, quick glance at subdomains and mail if the client sends email from the brand.
7. Legal signals if you claim compliance theater is out of scope, you still want privacy policy and cookie/consent rows not silently missing.
8. Copy fix prompts into tickets for whatever you will actually fix before go-live. Rescan those URLs.
9. Share a portal or PDF that matches what you said on the call.

# Authorized production host, tiny smoke beside the scan
curl -sI "https://www.client.example/" | rg -i "^(HTTP/|content-security-policy|strict-transport-security):"
curl -sL "https://www.client.example/robots.txt" | head -n 20

The smoke does not replace the scan. It catches the "wrong host" mistake early.

Pitfalls

Screenshotting Lighthouse from a laptop and calling it preflight. Skipping secrets because the site is "just marketing." Ignoring redirect chains because marketing likes the short link that expands into four hops. Letting MCP or an agent rewrite production without human review of the diff.

Another form of theater: a hundred-item checklist nobody owns. Keep owners next to open findings. Uptime monitoring after launch is how you notice regressions; preflight alone is not monitoring.

Related next step

Run the permissioned scan, write owners on open rows, fix what you promised, rescan, then share the portal. Start at slayslop.com when you need the ranked evidence instead of another slide template.

Minimum owners map

Assign roles before you share the portal: who owns CDN headers, who owns app CSP, who owns CMS templates for titles and names, who owns analytics tags that break hydration, who owns DNS redirects. Unowned rows become your problem at 11pm.

I keep the preflight note in the same place as the portal link. When someone asks "did we check secrets?" the answer is a finding state, not a memory of a meeting.

Soft close

If anything critical remains open, live secrets, availability failure, blocking robots on primary docs, do not call the checklist complete. Ship with documented risk only when the client accepts it in writing. Theater is a green deck. Preflight is a signed list of remaining rows.