Launch and Optimize the Store

What We Are Finishing in Part 6

The application is built, but a working development version is not the same thing as a launch-ready store. This final chapter checks the entire system as one connected business workflow.

Contents

• The launch process
• Separate development and production
• Configure production error handling
• Secure sessions, headers, and uploads
• Review database performance
• Optimize storefront images
• Add browser caching
• Validate product-page SEO
• Build the sitemap and robots.txt
• Test checkout and fulfillment
• Create automated backups
• Add monitoring and health checks
• Use a staged launch
• Post-launch maintenance
• Final launch checklist
• Frequently asked questions

The Launch Process

Separate Development and Production

Configure Production Error Handling

<?php

ini_set('display_errors', '0');
ini_set('display_startup_errors', '0');
ini_set('log_errors', '1');
ini_set(
    'error_log',
    __DIR__ . '/../private/logs/application.log'
);

error_reporting(E_ALL);

set_exception_handler(
    static function (Throwable $exception): void {
        $requestId = bin2hex(
            random_bytes(8)
        );

        error_log(
            sprintf(
                '[%s] %s in %s:%d%s%s',
                $requestId,
                $exception->getMessage(),
                $exception->getFile(),
                $exception->getLine(),
                PHP_EOL,
                $exception->getTraceAsString()
            )
        );

        http_response_code(500);

        echo 'The store encountered an error. Reference: ' .
            htmlspecialchars(
                $requestId,
                ENT_QUOTES,
                'UTF-8'
            );
    }
);

Secure Sessions, Headers, and Uploads

<?php

session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

ini_set('session.use_strict_mode', '1');
ini_set('session.use_only_cookies', '1');

session_start();

header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('X-Frame-Options: SAMEORIGIN');

if (!empty($_SERVER['HTTPS'])) {
    header(
        'Strict-Transport-Security: max-age=31536000; includeSubDomains'
    );
}

• Validate uploaded MIME type and actual image decoding.
• Limit upload size and image dimensions.
• Generate safe filenames rather than trusting uploaded names.
• Prevent script execution inside upload directories.
• Keep API tokens and database credentials outside public_html.
• Use CSRF protection on every state-changing form.

Review Database Performance

EXPLAIN
SELECT
    item_number,
    title,
    line,
    short_description,
    price,
    likes
FROM shirts
WHERE active = 1
  AND line = 'The American Slice'
ORDER BY item_number DESC
LIMIT 24;

• Select only the columns needed by the page.
• Avoid one additional query for every product card.
• Index active status, collection, item number, and foreign keys.
• Paginate catalog results.
• Use local data instead of external API requests on page load.

Optimize Storefront Images

<picture>
    <source
        srcset="/images/1001/catalog.avif"
        type="image/avif"
    >

    <source
        srcset="/images/1001/catalog.webp"
        type="image/webp"
    >

    <img
        src="/images/1001/catalog.jpg"
        alt="Bigfoot barber graphic T-shirt"
        width="900"
        height="900"
        loading="lazy"
        decoding="async"
    >
</picture>

Add Browser Caching

<IfModule mod_expires.c>
    ExpiresActive On

    ExpiresByType image/avif "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"

    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

Validate Product-Page SEO

Build the Sitemap and robots.txt

User-agent: *
Allow: /

Disallow: /admin/
Disallow: /manage/
Disallow: /api/

Sitemap: https://theconspiracyshirtcompany.com/sitemap.xml

Test Checkout and Fulfillment End to End

• The correct product, color, and size appear in checkout.
• The Shopify price matches the storefront price.
• Discount codes and free-shipping rules work correctly.
• Tax and shipping behavior are correct.
• The order reaches Printify with the right variant and artwork.
• Confirmation and tracking emails are delivered.

Create Automated Backups

#!/usr/bin/env bash

set -euo pipefail

BACKUP_ROOT="$HOME/store-backups"
STAMP="$(date -u +%Y-%m-%d_%H-%M-%S)"
BACKUP_DIR="$BACKUP_ROOT/$STAMP"

mkdir -p "$BACKUP_DIR"

mysqldump   --single-transaction   --quick   --lock-tables=false   -u "$DB_USER"   -p"$DB_PASSWORD"   "$DB_NAME"   | gzip   > "$BACKUP_DIR/database.sql.gz"

tar -czf   "$BACKUP_DIR/product-images.tar.gz"   "$HOME/public_html/images"

find "$BACKUP_ROOT"   -mindepth 1   -maxdepth 1   -type d   -mtime +30   -exec rm -rf {} \;

Add Monitoring and Health Checks

<?php
/**
 * /health.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../private/connection.php';

header(
    'Content-Type: application/json; charset=utf-8'
);

header('Cache-Control: no-store');

$status = [
    'ok' => true,
    'time' => gmdate('c'),
    'database' => false,
];

try {
    $pdo->query('SELECT 1');
    $status['database'] = true;
} catch (Throwable $exception) {
    $status['ok'] = false;

    error_log(
        'Health check failed: ' .
        $exception->getMessage()
    );
}

http_response_code(
    $status['ok'] ? 200 : 503
);

echo json_encode(
    $status,
    JSON_UNESCAPED_SLASHES
);

Use a Staged Launch

Post-Launch Maintenance

Final Launch Checklist

• Development and production configurations are separate.
• Production errors are logged but not displayed publicly.
• Private credentials remain outside the public web root.
• HTTPS is enforced across the store.
• Admin pages require authentication and authorization.
• State-changing actions use CSRF protection.
• PHP sessions use secure cookie settings.
• Image uploads validate type, size, and dimensions.
• Database queries use prepared statements.
• Catalog filters and relationships are indexed.
• Catalog results are paginated.
• Product images are compressed and correctly sized.
• Production artwork is separate from web images.
• Static assets use caching and cache busting.
• Product titles, descriptions, and canonical URLs are unique.
• Missing products return a true 404 response.
• Product and breadcrumb structured data validate.
• The XML sitemap includes active products and guides.
• Internal links and image paths have been checked.
• Color and size selections map to the correct Shopify variant.
• Shipping, discounts, taxes, and prices have been tested.
• A complete Shopify-to-Printify test order has been completed.
• Database and file backups run automatically.
• A backup restore has been tested.
• Application and API errors are monitored.
• Health checks detect site or database failures.
• The store has been tested on mobile and desktop.
• The launch begins with a limited audience.
• Post-launch maintenance responsibilities are documented.

Launch and Optimization FAQ