I built a WordPress site with AI. What should I check before launch?

A WordPress site built with AI can be safe to publish, but there are important launch considerations to avoid potential issues. After a site appears functional, there are a few specific checks that often get overlooked.

One key item is search engine visibility. In WordPress, go to Settings → Reading and ensure the "Discourage search engines from indexing this site" checkbox is unchecked. Leaving this on prevents the site from appearing in search results even after launch.

Another vital check is the default admin username. If an "admin" account still exists, an attacker only needs to guess the password, not the username. Create a new admin account and delete any leftover "admin" account.

WP_DEBUG should be turned off in production. In wp-config.php, set WP_DEBUG to false. Leaving it on can display debugging information like file paths, which shouldn't be publicly visible. Also, set WP_DEBUG_DISPLAY to false to prevent those messages from being shown on the page.

A leftover debug.log file can be an issue. After turning debug mode off, the log file may still be present in /wp-content/debug.log. If it exists, delete it to avoid potential security risks.

Another setting to verify is DISALLOW_FILE_EDIT. This one line in wp-config.php removes the theme and plugin code editor from wp-admin. Most production sites don't need this enabled, so ensure it's set to false.

Finally, check if XML-RPC is enabled. Some setups require it, like with Jetpack or certain mobile apps. If it's not needed, disable it to remove an unnecessary exposed endpoint.

While these checks typically take less than a minute each, remembering to do them consistently can be challenging. My launch routine involves checking, cleaning up, and keeping a record of what was verified. Recording the checks aids in demonstrating the verification process to clients.

To streamline this process, I developed a small WordPress plugin called Noshi-Kanamer. It automatically checks the status of these six items and generates a plain-text report that serves as a record of the launch checks. However, it can't decide whether your permalink structure makes sense or whether XML-RPC is actually required for your specific setup. Noshi-Kanamer handles the routine tasks, while you make the judgment calls on the more nuanced aspects of the launch.