Launch day is the worst time to discover that password resets don't send, or that checkout breaks on one phone. A structured QA pass catches these problems early. Use this checklist before every major release of a web or mobile app.
Core functionality
- Sign-up, login, logout and password reset work end to end.
- Every form validates input and shows clear error messages.
- The core workflow (the reason users come) works for every user role.
- Permissions are enforced: users cannot see or change other users' data.
- Emails and notifications are sent, correctly worded and link to the right place.
Payments and money paths
- New purchase or subscription succeeds and grants access.
- Failed payments are handled gracefully.
- Upgrades, downgrades, cancellations and refunds behave as expected.
- Prices, taxes and currencies display correctly.
(For subscription details, see our Stripe billing guide.)
Devices and browsers
- The app works on the latest Chrome, Safari, Firefox and Edge.
- Layouts work on phones, tablets and large screens.
- Mobile apps are tested on real iOS and Android devices, not only simulators.
Performance
- Key pages load quickly on a slow mobile connection.
- Images are optimised and lazy-loaded.
- The app stays responsive with realistic amounts of data.
Security
- All traffic uses HTTPS.
- Secrets and API keys are not exposed in the frontend or repository.
- Inputs are protected against injection and cross-site scripting.
- Dependencies are up to date with no known critical vulnerabilities.
- Backups exist and a restore has been tested.
Accessibility
- Everything can be used with a keyboard, with visible focus.
- Images have alt text and form fields have labels.
- Text has sufficient colour contrast.
SEO and analytics (for public websites)
- Each page has a unique title, description and one main heading, plus a sitemap; see why websites fail to rank.
Release readiness
- Error monitoring and logging are live, and the team knows how to roll back.
Manual vs automated testing
Manual testing finds usability problems and edge cases a script would miss. Automated tests protect the most important paths (sign-up, login, payments and the core workflow) on every change, so old bugs do not come back. The best teams use both.
Make QA part of every sprint
Testing only at the end is expensive. Every one of our remote team plans includes a QA engineer, so quality is checked throughout development rather than bolted on before launch.
Want an independent QA review before your launch? Book a free consultation or read about our software quality services.