The go-live checklist

Files every site ships with

• 404.html at the site root: on-brand, one line, links home + the main CTA.
• robots.txt: allow all, explicit allow lines for GPTBot, ClaudeBot, PerplexityBot, with the student-facing comment about sites that block AI crawlers by accident.
• sitemap.xml: every real page, canonical host.
• llms.txt: the one-page cheat sheet for AI. Plain-text facts: what, where, services and prices, hours, how to take the next step, FAQ answers.
• privacy/index.html: plain-English privacy page. What the form collects, why, who sees it, how to ask for deletion. Sample text, labeled as a template, not legal advice.
• terms/index.html: ONLY where the spec calls for it (bookings, payments, user submissions).
• thanks/index.html: where the form lands after submit. Says what happens next.
• _headers (Cloudflare static-assets format), applied to /*: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: DENY, Strict-Transport-Security: max-age=31536000; includeSubDomains, Permissions-Policy: camera=(), microphone=(), geolocation=().
• .assetsignore: .git, .git/, .gitignore, .github/, plans/, *.md, wrangler.jsonc, node_modules/, .wrangler/, .assetsignore, src/. A deploy from a git clone serves EVERYTHING in the folder unless this file says otherwise. Never skip it.
• wrangler.jsonc: Workers static assets, "directory": ".", "html_handling": "auto-trailing-slash", "not_found_handling": "404-page". No routes yet (staging on workers.dev first). Worker name = awp-<site-slug>.
• assets/favicon.svg + <link rel="icon"> on every page.
• assets/og.png or og.svg-derived 1200x630 image + Open Graph + Twitter card tags on every page.

Every page

• Unique <title> and meta description. Canonical link tag.
• One H1. Main CTA visible above the fold. CTA repeated at the bottom.
• Alt text on every image. Images compressed (target under 300KB each, hero under 450KB), width/height attributes set, loading="lazy" below the fold.
• Responsive at 375px and 1280px. No horizontal scroll at 375px. Tap targets 44px minimum.
• Mobile nav works with keyboard and Escape. prefers-reduced-motion respected.
• Color contrast AA for body text.
• JSON-LD that matches visible content exactly.

Readable by AI agents

• The first line under the H1 is a plain definition: what the business is, who it is for, what it does. No slogan.
• The first H2 on the home page is the visitor's question in their own words, answered in 100 words or fewer directly under it.
• Prices, reviews and key facts are in the raw HTML, never injected by script. Testimonials are selectable text, not images.
• Facts that change (prices, counts, ratings) carry "as of [month year]".
• robots.txt also allows meta-webindexer.
• aria-label on every icon-only control, a visible <label> on every field, alt text on every image, semantic tags (<header>, <nav>, <button>) instead of styled <div>s.
• No broken links. Explainer and comparison pages show "published" and "updated" dates near the top and get re-read every 30 to 90 days.

Forms

• Real labels, required fields marked, inline error states (empty / bad email / bad phone) written in plain English. No alert() popups.
• Demo builds are not wired to a backend. On valid submit, go to /thanks/. Leave the comment <!-- GO-LIVE: wire to a form endpoint + add Cloudflare Turnstile + rate limit -->.
• A hidden honeypot field is fine in the draft.

What is deliberately not in a draft

• No analytics, pixels, chat widgets, third-party embeds, or external scripts. Fonts from Google Fonts are the one allowed external request.
• No cookie banner. Cloudflare Web Analytics is cookieless, so a plain site does not need one. A banner is only required once ad pixels or cookie-setting embeds are added. (Course teaching point: do not cargo-cult a banner.)
• No secrets, API keys, or tokens anywhere in the folder.

Fictional-business rules (example sites only)

• Slim always-visible top banner: "Example website built for the AI Website Pro course. [Name] is a fictional business."
• .example domain in all emails/canonicals, 555-01xx phone numbers, fictional town (Riverbend, NV 89000 unless the spec says otherwise).
• Every review, team member, project, or client is visibly tagged "sample".
• <meta name="robots" content="noindex"> on every page. Fake businesses must never rank.
• Never reference Economic Ninja, ImDyelon, The Arsenal, or any real brand in site content beyond the banner's course name.

Copy rules (all sites)

No emojis, no exclamation points, no em dashes, no lorem ipsum, no "Welcome to our website", no sentence that could be pasted onto a different business unchanged. Left-align paragraphs and lists; center only H1s and CTA bands. Tie the last two words of every headline with   so no orphan word wraps alone.