WordPress SEO Checklist: Settings to Check Before and After Launch

WordPress is flexible, and that is exactly why launches go wrong. A site built on a staging copy carries over a setting that hides it from search. A permalink change breaks every link. An SEO plugin and WordPress itself both publish a sitemap. Comment spam fills the database with links to casinos. None of these are exotic, and all of them can be found by reading a handful of settings screens.

This WordPress SEO checklist covers the core settings that decide whether a site can be crawled, indexed and kept tidy, followed by what to do in the first days after launch. It sticks to what WordPress itself does. It does not rank plugins or promise results, and it does not replace content quality, which is what people and search engines actually come for.

It is for site owners and freelancers launching or relaunching a WordPress site. You need administrator access, about an hour, and a backup. By the end you will know that search engines are allowed in, that your URLs are stable, that HTTPS is working and that there is one sitemap you can submit.

Before you begin

Take a full backup of files and database, and note who holds the hosting, domain and WordPress administrator logins. Use a staging copy for risky changes such as permalinks. Check which SEO plugin, if any, is active, because it may add its own settings for titles, sitemaps and robots directives that overlap with WordPress core.

If this is a redesign of an existing site, export or crawl the old URLs first so you can map redirects. The checklist below assumes the site address is final. If it is not, read Website Launch SEO Checklist for the wider plan first.

Step-by-step instructions

Step 1: Make sure search engines are allowed in

Go to Settings > Reading and find Search engine visibility. If Discourage search engines from indexing this site is ticked, untick it and save. WordPress's own documentation describes what that checkbox does: it asks search engines not to index the site, and since WordPress 5.3 it does so by outputting a robots meta tag with noindex in the page head. The same documentation notes that this does not block access to the site; it is up to search engines to honor the request.

This is an easy launch mistake to make, because the setting travels with a staging copy of the database. There is a full walkthrough in The WordPress "Discourage Search Engines" Setting: Check It Before You Launch.

Verify in the page source of your home page: search for robots and make sure there is no noindex. Also check for a noindex set by an SEO plugin on individual pages or post types.

What success looks like: The box is unticked, and the home page source contains no noindex robots meta tag.

Step 2: Choose permalinks before you publish

Settings > Permalinks controls your URL structure. WordPress offers Plain (/?p=123), Day and name, Month and name, Numeric, Post name (/sample-post) and a custom structure. Choose one that is readable and stable before any content is public. You can also set a custom category base and tag base in the same screen.

Changing the structure on a live site changes every URL, so old links and any indexed addresses stop working unless you redirect them. If you must change, plan redirects and test them first. See 301 vs 302 Redirects: Use the Right One for Each Situation. WordPress notes that visiting the Permalinks screen flushes the rewrite rules, which fixes many unexplained 404 errors on posts. If .htaccess is not writable, WordPress shows the rewrite rules for you to add by hand.

What success looks like: Post and page URLs are readable, a post opens at its address, and no URL ends in ?p= followed by a number.

Step 3: Set up HTTPS properly

In Settings > General, the WordPress Address and Site Address should use https:// once your certificate is installed. WordPress's HTTPS documentation says the server needs a working certificate and secure virtual host before the settings will work. To force HTTPS for logins and the admin area, define FORCE_SSL_ADMIN as true in wp-config.php; the documentation says that defining it in a plugin file is not sufficient. Behind a reverse proxy or CDN that ends HTTPS before WordPress, the same page warns of redirect loops, so check how WordPress detects HTTPS in that setup.

After the switch, search your content, theme and widgets for old http:// references. Fix Mixed Content: Remove http:// Resources From HTTPS Pages shows how to find them. Make sure the http:// version redirects to the https:// version in one step.

What success looks like: The padlock shows on every page, http://example.com redirects once to https://example.com, and the browser console shows no mixed content warnings.

Step 4: Decide your canonical host and test it

Pick www or non-www, and make sure the other redirects to it. Settings > General shows the address WordPress is configured for, and your hosting or CDN redirect rules should agree with it. See www vs Non-www: Pick One Canonical Host.

What success looks like: All four variants (http/https, www/non-www) end at the same final address in at most one redirect.

Step 5: Use one sitemap and check it

Since WordPress 5.5, core generates a sitemap index at /wp-sitemap.xml. By default it includes public post types, public taxonomies and author archives, with up to 2,000 URLs per sitemap page. When your search visibility setting discourages indexing, core sitemaps are disabled, and WordPress references the sitemap in the generated robots.txt. Core sitemaps need the PHP SimpleXML extension; without it the server returns HTTP 501 instead of the sitemap.

If an SEO plugin provides its own sitemap, use that one or core, not both. Decide which one you will submit, and turn the other off (core exposes filters for this, and plugins usually have a setting). Look inside the sitemap you keep: author archives, tag pages or attachment pages you do not want in search should not be listed. Then read How to Create a Valid XML Sitemap for Your Website for the rules a good sitemap follows.

What success looks like: One sitemap loads in a browser, lists only canonical, indexable URLs and is referenced from robots.txt.

Step 6: Check titles, descriptions and headings

WordPress themes output the page title, and an SEO plugin or the block editor may supply descriptions. Check that each template has a unique title, that the site title and tagline in Settings > General are meaningful, and that each page has one clear main heading. Write SEO Title Tags and Meta Descriptions That Match Search Intent covers the details.

What success looks like: Spot-check five page types (home, post, page, category, search). Each has a distinct <title> and no placeholder text.

Step 7: Tame comments and spam

Open Settings > Discussion. Comment spam is full of links, and WordPress lets you hold comments in the moderation queue when they contain a number of links you set, require approval by an administrator, and close comments on older posts after a number of days. Decide what fits your site, and if you do not want comments at all, untick the option for new articles. Also check the pingback and trackback options. A moderation queue is easier than cleaning spam pages later; if spam already got in, see Hacked Site SEO Spam: Find and Clean Injected Spam Pages.

What success looks like: A test comment with several links lands in the moderation queue instead of appearing on the page.

Step 8: After launch, submit and monitor

Add the site to Google Search Console and Bing Webmaster Tools and submit your one sitemap. Set Up Google Search Console: Complete Website Owner Checklist and Set Up Bing Webmaster Tools and Verify Your Website walk through it. Use URL Inspection on the home page and one deep page to confirm Google can fetch them.

Crawvix's scan flags accidental noindex on sampled pages, a robots.txt that blocks Googlebot or Bingbot, and sitemap problems, so a baseline scan right after launch is a quick cross-check of Steps 1, 4 and 5.

What success looks like: Search Console accepts the sitemap and shows the home page as fetchable.

What WordPress settings do not do

The visibility checkbox is a request, not a lock. WordPress cannot add X-Robots-Tag headers to images, PDFs or other files that the web server delivers directly, so keeping those files out of search needs server configuration. A tidy configuration does not promise indexing or rankings; it only removes avoidable obstacles.

Final verification checklist

Settings > Reading: the "Discourage search engines" box is unticked.
The home page source has no noindex robots meta tag, and no SEO plugin sets one by mistake.
Permalinks use a readable structure, and posts open at their addresses.
Site Address and WordPress Address use https://, and HTTP redirects to HTTPS once.
There is one canonical host (www or not), and the other redirects to it.
One sitemap loads, lists only indexable URLs and is referenced in robots.txt.
Titles and descriptions are unique, with no placeholder text.
Comment moderation is configured, and a test spam comment is held.
The sitemap is submitted in Search Console and Bing Webmaster Tools.

Common mistakes to avoid

Launching with "Discourage search engines" ticked. Untick it and confirm there is no noindex in the source.
Changing permalinks after launch without redirects. Every old URL breaks. Redirect them or leave the structure alone.
Two sitemaps. Core and a plugin both publishing one creates duplicates. Keep one.
Forgetting mixed content after the HTTPS switch. Search for stored http:// links and fix them.
Assuming robots.txt hides staging. Blocking crawling does not keep pages out of the index; WordPress stopped adding Disallow: / in version 5.3 for this reason, preferring a noindex tag.
Leaving sample content. Delete the sample post and page, and review the site title and tagline.
Skipping comment moderation. Link spam piles up fast. Hold comments with links.
Expecting the checklist to deliver results by itself. It removes obstacles; it does not create demand.

Frequently asked questions

Does WordPress need an SEO plugin?

Not necessarily. Core handles the title tag, permalinks, a basic sitemap and the visibility setting. A plugin can add finer control over titles, descriptions and robots directives, but choose based on features you need, and keep to one sitemap source.

Where is my WordPress sitemap?

Core serves a sitemap index at /wp-sitemap.xml, unless your visibility setting discourages indexing or a plugin or filter disables it. If you use an SEO plugin, its sitemap may be at a different address.

Can I change my permalink structure later?

You can, but all existing URLs change. Without redirects from the old to the new addresses, visitors and search engines hit 404 errors. Do it on staging first and map every old URL.

How do I check that my site is not set to noindex?

View the page source of the home page and search for noindex. You can also use URL Inspection in Search Console. Remember that headers, plugins and individual page settings can add it as well.

Is the "Discourage search engines" setting enough to keep a site private?

No. The WordPress documentation says it does not block access to your site and that honoring it is up to search engines. Use a password or server access control for anything private.

Official references

Next step: See how Crawvix checks a website and capture a baseline once scanning opens. This guide provides technical information, not a guarantee of rankings, traffic or index inclusion.