Drupal Go-Live Checklist — Pre-Launch Checks, Hardening and Monitoring

In this tutorial, you'll learn the complete Drupal go-live checklist: pre-launch security review, performance testing, configuration verification, monitoring setup, SEO readiness, and deployment best practices for launching your site to production.

What You'll Learn

• Pre-launch security checklist: trusted host patterns, file permissions, cron key, admin password strength, update status
• Performance checklist: CSS/JS aggregation, Caching enabled, BigPipe on, image optimization, database optimization, CDN
• Configuration checklist: clean URLs, error reporting off, maintenance mode off, search index built, cron configured
• SEO checklist: sitemap generated, redirects configured, robots.txt, metatag defaults, Google Search Console
• Monitoring setup: New Relic, Pingdom, Uptime Robot, server monitoring, log monitoring
• Deployment Process: code freeze, database backup, file backup, maintenance mode, deploy, config import, cache rebuild, test
• Post-launch tasks: verify contact form, test search, check 404s, verify SSL, test load

Why It Matters

Launching a Drupal site is a critical moment. Rushing through it means launching with misconfigured security, broken forms, or performance bottlenecks. A proper go-live checklist ensures that every aspect of the site is verified before users arrive. Organizations that skip this step often discover issues after launch — lost form submissions, slow page loads, or security holes. The go-live checklist is the difference between a successful launch and a stressful one.

Real-World Use

A marketing agency launches a Drupal site for a client's product launch. Before go-live, they run through the checklist: security is hardened (trusted host patterns, 2FA for admins, file permissions locked down), performance is tested (1,000 concurrent users with 200ms response time), SEO is configured (XML sitemap submitted to Google, redirects from old site mapped), and monitoring is set up (uptime alerts, error logging, performance tracking). The launch goes smoothly. When traffic spikes on launch day, monitoring catches a database Connection Pool issue and the team resolves it within minutes.

Learning Path

flowchart LR
  A[Backups and Maintenance] --> B[Go-Live Checklist]
  B --> C[Security Checks]
  C --> D[Performance Checks]
  D --> E[Configuration Checks]
  E --> F[SEO Checks]
  F --> G[Monitoring Setup]
  G --> H[Deployment Process]
  H --> I[Post-Launch Tasks]

Pre-Launch Security Checklist

Run these checks before opening the site to visitors:

Trusted Host Patterns

<?php
// settings.php: Verify trusted host patterns
$settings['trusted_host_patterns'] = [
  '^www\.example\.com$',
  '^example\.com$',
  '^staging\.example\.com$',
];

File Permissions

# Verify restrictive permissions
find web/ -type d -exec chmod 755 {} \;
find web/ -type f -exec chmod 644 {} \;
chmod 750 web/sites/default
chmod 640 web/sites/default/settings.php
chmod 640 web/sites/default/services.yml
chmod 775 web/sites/default/files  # Needs write for uploads

Cron Key

<?php
// settings.php: Set a cron key
$settings['cron_key'] = bin2hex(random_bytes(32));

Admin Password Strength

# Force password reset for all admin accounts
drush user:password admin --password="N3w-Secure-P@ssw0rd!"

# Verify user 1 email is a real email
drush user:info 1

Update Status

# Check for security updates
composer outdated drupal/*
drush pm:list --status=not-updated

# Enable update status module
drush pm:enable update

# Manually check for updates
drush pm:refresh
drush pm:updatestatus

Disable Development Modules

# Remove development modules
drush pm:uninstall devel kint webprofiler

# Verify no dev modules remain
drush pm:list --status=enabled --package=Development

Error Reporting

<?php
// settings.php: Disable error display
$settings['error_level'] = ERROR_REPORTING_HIDE;

Performance Checklist

CSS/JS Aggregation

<?php
// settings.php: Enable aggregation
$config['system.performance']['css']['preprocess'] = true;
$config['system.performance']['js']['preprocess'] = true;

Caching

<?php
// settings.php: Enable caching
$config['system.performance']['cache']['page']['use_internal'] = true;
$config['system.performance']['cache']['page']['max_age'] = 21600;
$settings['cache']['bins']['render'] = 'cache.backend.database';
$settings['cache']['bins']['dynamic_page_cache'] = 'cache.backend.database';

BigPipe

<?php
// settings.php: Enable BigPipe
$settings['big_pipe'] = true;

Image Optimization

# Verify image styles use WebP
drush config:get image.style.large effects

# Enable lazy loading
# Add to theme: $variables['attributes']['loading'] = 'lazy';

Database Optimization

# Run database optimization
drush sql:query "OPTIMIZE TABLE node_field_data"
drush sql:query "OPTIMIZE TABLE users_field_data"

# Check for missing indexes
# Review slow query log on database server

CDN Configuration

<?php
// settings.php: CDN/reverse proxy
$settings['reverse_proxy'] = true;
$settings['reverse_proxy_addresses'] = ['CDN_IP_ADDRESSES'];

Configuration Checklist

Clean URLs

# Verify clean URLs are working
# Visit https://example.com/node/1
# Should not show index.php?q= in the URL

# If using Apache, ensure mod_rewrite is enabled
sudo a2enmod rewrite

Error Reporting

<?php
// settings.php: Production error settings
$settings['error_level'] = ERROR_REPORTING_HIDE;
ini_set('display_errors', 0);

Maintenance Mode

# Verify maintenance mode is OFF
drush state:get system.maintenance_mode
# Should output: 0

Search Index

# Build search index
drush search-api:index

# Check indexing status
drush search-api:status

Cron Configuration

# Ensure system cron is set up
crontab -l
# Should show: */15 * * * * drush cron

# Or verify cron key works
curl https://example.com/cron/YOUR-CRON-KEY

Configuration Export

# Final config export before launch
drush cex

# Verify config directory is in version control
git status config/sync/

SEO Checklist

XML Sitemap

# Generate sitemap
drush simple_sitemap:generate

# Verify sitemap URL
# Visit: https://example.com/sitemap.xml

# Submit to Google Search Console
# Coverage: sitemap.xml

Redirects

# Configure redirects from old URLs
# Use the Redirect module
drush pm:enable redirect

# Add redirects via UI or config
drush config:set redirect.settings

robots.txt

# robots.txt for production
User-agent: *
Disallow: /core/
Disallow: /profiles/
Disallow: /vendor/
Disallow: /node/add/
Disallow: /user/
Disallow: /admin/
Allow: /sitemap.xml
Crawl-delay: 10

Sitemap: https://example.com/sitemap.xml

Metatag Defaults

# Verify metatag defaults
drush config:get metatag.settings

# Check homepage meta tags
curl -s https://example.com | grep -i meta

Google Search Console and Analytics

<?php
// Add Google Search Console verification
// In theme's html.html.twig or via module

// Add Google Analytics (use the Google Tag module)
drush pm:enable google_tag

Monitoring Setup

Uptime Monitoring

Configure uptime monitoring services:

• Pingdom: HTTP monitor checking every 5 minutes
• Uptime Robot: Free tier monitors 50 URLs every 5 minutes
• StatusCake: Advanced monitoring with SSL checks

Performance Monitoring

# Setup New Relic PHP agent
# Verify by checking:
# https://one.newrelic.com > APM > Your App

; newrelic.ini
newrelic.appname = "Drupal Production"
newrelic.transaction_tracer.enabled = true
newrelic.transaction_tracer.threshold = "apdex_f"
newrelic.error_collector.enabled = true

Server Monitoring

Configure server-level monitoring:

• CPU usage: Alert at >80% for 5 minutes
• Memory usage: Alert at >85%
• Disk usage: Alert at >80%
• Database connections: Alert at >80% of max connections
• Load average: Alert when > number of CPU cores

Log Monitoring

# Monitor Drupal logs for errors
drush watchdog:show --severity=error --count=10

# Set up log forwarding to external service
# Use the syslog module to forward to a central log server
drush pm:enable syslog

Error Alerting

# Configure email alerts for critical errors
# Use the Rules module or custom hook

Deployment Process

Pre-Deployment (Code Freeze)

1. Announce code freeze to the team
2. No commits to the production branch without approval
3. Run final security scan
4. Run final performance test
5. Verify all tests pass

Deployment Steps

#!/bin/bash
# deployment.sh - Complete go-live deployment

# Step 1: Backup
echo "Creating backups..."
drush sql:dump --gzip > pre-deploy-db.sql.gz
tar -czf pre-deploy-files.tar.gz web/

# Step 2: Maintenance mode
echo "Enabling maintenance mode..."
drush state:set system.maintenance_mode 1

# Step 3: Deploy code
echo "Deploying code..."
git pull origin main
composer install --no-dev --optimize-autoloader

# Step 4: Apply database updates
echo "Running database updates..."
drush updatedb --no-interaction

# Step 5: Import configuration
echo "Importing configuration..."
drush cim --no-interaction

# Step 6: Rebuild cache
echo "Rebuilding caches..."
drush cr

# Step 7: Verify
echo "Verifying deployment..."
drush status
drush sql:query "SELECT COUNT(*) FROM node_field_data"
curl -s -o /dev/null -w "%{http_code}" https://example.com/

# Step 8: Exit maintenance mode
echo "Disabling maintenance mode..."
drush state:set system.maintenance_mode 0

echo "Deployment complete."

Rollback Plan

#!/bin/bash
# rollback.sh - Emergency rollback

# Restore database
gunzip -c pre-deploy-db.sql.gz | drush sql:cli

# Restore files
tar -xzf pre-deploy-files.tar.gz -C /var/www/

# Rebuild cache
drush cr

# Exit maintenance mode
drush state:set system.maintenance_mode 0

echo "Rollback complete."

Post-Launch Tasks

Within First Hour

• Verify site loads on desktop and mobile
• Submit a contact form and confirm it arrives
• Test user registration
• Test search functionality
• Verify SSL certificate (no mixed content warnings)
• Check for broken links (minimum 10 internal pages)
• Monitor error logs for 404s and 500s

Within First Day

• Review server resource usage (CPU, memory, disk)
• Check database connection pool
• Monitor cache hit rates
• Verify CDN is serving cached assets
• Check Google Search Console for crawl errors
• Review Drupal logs for warnings or errors
• Run screenshot comparison (staging vs production)

Within First Week

• Review analytics data for traffic patterns
• Identify slowest pages from real user monitoring
• Check for 404 errors in Google Search Console
• Verify XML sitemap was indexed by search engines
• Monitor uptime reports
• Review backup logs (confirm backups are running)

Ongoing

• Monitor security advisories weekly
• Review performance reports monthly
• Test backup restoration quarterly
• Review and update this checklist before every major deploy

Common Mistakes

1. Skipping the performance test before launch: Discovering that the site cannot handle traffic after launch is catastrophic. Run load tests with expected peak traffic before going live.

2. Forgetting to disable development modules: Devel, Kint, and WebProfiler expose sensitive information and slow down the site. Remove them from production.

3. Not testing forms before launch: Contact forms, registration forms, and checkout forms might fail silently. Submit each form type and verify the result reaches the right destination.

4. Having no rollback plan: If the deployment fails, every minute offline costs money and reputation. Have a tested rollback script ready before you start the deployment.

5. Not monitoring after launch: The go-live is not the end — it is the beginning. Monitor uptime, performance, errors, and user feedback for at least a week after launch.

Practice Questions

1. What are the first five security checks you should run before a Drupal site goes live?
2. You deploy a site and notice that contact form submissions are not arriving. What could be wrong, and how do you fix it?
3. What is the difference between a deployment script and a rollback script, and why do you need both?
4. Challenge: Create a complete go-live document for a Drupal e-commerce site. The site has: product catalog (2,000 items), user accounts, shopping cart, checkout with payment gateway, blog, contact form, and newsletter signup. For each component, identify: the specific checks needed before go-live, the monitoring to set up, the common failure points, and the recovery procedure. Include a deployment checklist with timestamps and a rollback checklist with expected recovery time.

FAQ

Mini Project

Goal: Create and execute a complete go-live plan for a Drupal site.

1. Create a go-live checklist document with all checks organized by category (security, performance, configuration, SEO, monitoring)
2. Write the deployment script with: backup steps, code deploy, database update, config import, cache rebuild, verification steps, and maintenance mode toggle
3. Write the rollback script with: database restore, file restore, cache rebuild, and maintenance mode exit
4. Set up uptime monitoring (Pingdom or Uptime Robot) and error monitoring (Drupal watchdog or New Relic)
5. Configure SSL certificate and verify with SSL Labs
6. Run a load test simulating 500 concurrent users
7. Execute the deployment on a staging environment first, then on production
8. Verify all post-launch tasks: contact form, search, SSL, 404s, analytics
9. Write a post-launch report documenting: deployment time, issues encountered, performance metrics, monitoring results, and recommendations for the next deploy

What's Next

Congratulations on completing the Drupal tutorial series. You have learned everything from Drupal basics and installation to security hardening, module development, performance optimization, and go-live procedures. To continue your learning, explore PHP for deeper backend development skills, Twig for advanced theming, and MySQL for database optimization. Visit Drupal.org for official documentation and the Drupal community for support.