The Next.js Production Checklist We Actually Use

A green CI build is not a production app. Before we flip traffic, we run the same checklist every time - because the failures that hurt users are boring, predictable, and almost always preventable.

Performance & caching

• ✓LCP/INP/CLS acceptable on key templates (field + lab)
• ✓Images use Next Image (or equivalent) with sane sizes
• ✓Fonts loaded without layout thrash; subset where possible
• ✓Cache headers / ISR / static choices match content freshness needs
• ✓No accidental dynamic rendering on pages that should be static

Reliability & errors

• ✓Error monitoring wired (client + server) with release markers
• ✓Error boundaries on critical interactive islands
• ✓Health check / uptime on the real production URL
• ✓Rollback path rehearsed - not theoretical

SEO & metadata

• ✓Unique title/description per indexable route
• ✓Canonical URLs correct; no accidental noindex on prod
• ✓OG images render for key pages
• ✓Sitemap + robots agree with what should be crawled
• ✓Structured data validates where you claim rich results

Security basics

• ✓Security headers set (CSP where feasible, referrer, frame controls)
• ✓Secrets only in env - none baked into client bundles
• ✓Auth cookies flagged appropriately; CSRF strategy understood
• ✓Dependency audit reviewed for high/critical issues

const required = ["DATABASE_URL", "AUTH_SECRET"] as const;
for (const key of required) {
  if (!process.env[key]) {
    throw new Error(`Missing required env: ${key}`);
  }
}

Launch day smoke

1. 01

   Critical user paths

   Sign-up, login, checkout, or contact - run by a human on production.

2. 02

   Forms & webhooks

   Submit real payloads; confirm email/Slack/CRM receipt.

3. 03

   Watch the first hour

   Error rates, p95 latency, and one real device check on cellular.

“Checklists aren’t bureaucracy. They’re how calm teams ship.”