How to QA a website before you launch it

Owner QA follows the route the owner built, in the order they built it. They submit the form with a value they know works, they come from the homepage they just edited, and they never press the back button after a confirmation. A stranger breaks that sequence. They land on a deep page from a search, submit a form empty, go back after the thank-you page, or open the site in a second tab and submit twice. Each of those can leave a page that works in order and fails out of order. The owner cannot see it, because the owner never did it that way.

• Submit every form empty, then with a wrong value, then with a correct one.
• Press the back button after each form submission and check the page does not submit again.
• Open a deep page directly from its address, not from the menu.
• Check that every footer and menu link goes to a page that exists.

Start with the paths, not the pages. A path is a sequence a visitor can take: the page a search brings them to, the link they press, the form they fill in and the page after it. Write each one on a line, with the entry point, the input and the expected result. Pages with no form still have paths, since a link can lead to a page that does not exist. A list of short paths is more useful than a page-by-page checklist, because the failures sit between pages. Keep the list next to the site, and add a line each time you build something new.

Three habits create the broken paths. The back button after a submit can resubmit a form, or show a page that was cached before the change. A reload in the middle of a form can clear the values or start a second submit. A direct link to a deep page can skip the step that sets up the page's data, so the page loads with nothing in it. None of these show when you click through in order from the homepage. Walk each form once with back, once with reload and once from a direct address, and write down what each one showed.

A walk through the paths shows that they work for a visitor. It does not show how the site holds up when someone submits a form on purpose with bad data, whether the terms and privacy page match what the business does, or whether the site stays up when many people arrive at once. Those need a security review, a legal or compliance review and a load test, each with its own tools or people. Keep them on the launch list separately, so a clean walk through the paths is not taken as clearance for the others.

Every new form, page or menu item adds a path, and a change to any shared part of the site can break a path you already walked. Rerun the same paths after each release, in the same order, and add the paths visitors found that were missing from your list. A run behind a login uses a test account you give it, so the signed-in paths belong on the same list.