Pre-launch check of a client site

On the Agency plans, the Pre-launch check page checks a site you are about to hand over, often still on a staging host, the way an attacker would see it once it is live. You get a verdict, a launch checklist and the fixes to make.

Check a site

1. Open Pre-launch check and enter the host of the site, for example staging.client-shop.com or www.client-shop.com. Add a name and a client if you like.
2. Press Continue.
3. If one of your verified domains covers the host (the domain itself or one of its subdomains), the check starts at once.
4. Otherwise, prove that you manage the site: put a text file at https://<host>/.well-known/perimetry-cloud.txt holding exactly the line shown on the page, then press Check now. You can remove the file afterwards.

The check takes two to five minutes. You can run 30 checks per 30 days on Agency and 100 on Agency Plus; a host that could not be proved is not counted. Viewers cannot run them.

If the staging site asks for a password, open it to the public for the time of the check, or let our robot through (its user agent starts with PerimetryCloud-Launch).

What it checks

Only the host you entered, not the rest of the domain, which may still be the old site:

• HTTPS, the certificate and the TLS versions;
• the security headers, the Content Security Policy and the cookie flags;
• software versions shown to visitors;
• third-party scripts (their origin and integrity), outdated JavaScript libraries and mixed content;
• login forms sent over HTTPS;
• files and admin pages left reachable (.env, backups, .git, database dumps, admin panels);
• WordPress: XML-RPC, user listing, directory listing and plugins with known vulnerabilities;
• trackers that load before consent, and security.txt.

Nothing is changed on the site: we read its pages, its headers and a list of well-known file paths.

Read the result

• Not ready: at least one critical or high finding. Fix it before the launch.
• Ready, with fixes to plan: medium findings only. Nothing blocks the launch, but plan the fixes for the following days.
• Ready to launch: only notes and improvements.

The launch checklist marks each item OK, To improve, To fix or Not applicable (WordPress items on another kind of site). Under What to fix, the findings are grouped as blocking, to fix after the launch, and notes, each with its fix.

Fix, then press Check again to confirm before you hand over. Once the site is live on a domain you watch, its full audits take over.

Checks are kept 90 days. Remove deletes one.