Four sites, four different definitions of finished. Now there's one checklist.

Four sites. Four different ideas of what a finished page looked like. Each one got its security headers, its dark mode support, its deploy checks bolted on separately, by whichever version of me was working that week.

That is how a header lands on three sites and quietly never makes it to the fourth. Nobody decides to skip it. There is just no single place that says what “shipped correctly” means, so each site ends up inventing its own standard.

I wrote that place down this week. The Content-Security-Policy header starts in report-only mode, so a wrong origin logs instead of taking the site down while I find what it actually needs to allow. Every page gets a color-scheme meta tag so a dark page does not inherit a light browser scrollbar. And after every deploy, I hit the live endpoint and check the real response. One of my own deploys once served every static file correctly and silently dropped every backend function for 16 hours and 37 minutes, and the deploy tool said success the whole time.

Twenty-one pages of that, checklist and code both, now sit on The Standard’s resources shelf. The short version is free: jaredhebb.com/workflows/website-best-practices.