These are the notes we actually answer from — each entry carries a real figure, a deadline, or a field name. It is the same text the chat window uses, not a separate marketing page.
All entries
- Domain and Cloudflare DNS
- Hosting and real cost
- Choosing the build approach
- Multilingual hreflang
- SEO hard thresholds
- GEO in five steps
- robots.txt and AI crawlers
- Content that gets cited
- Structured data priority
- How the AI platforms differ
- Choosing a jurisdiction
- Hong Kong: fees and process
- Hong Kong: annual return, audit, penalties
- Business bank account
- Taking payments: Stripe, PayPal, the three documents
- Six risk rules that keep accounts alive
- Mainland-side tax compliance
- US LLC and Singapore
- When a payment account is frozen
- Hong Kong incorporation: documents and turnaround
- Hong Kong company: fixed annual cost
- Hong Kong business bank accounts compared
- Stripe fees and payout routes
- Why a new PayPal account gets reviewed
- Which US state for an LLC
- Getting an EIN without an SSN
- What Mercury, Relay and Wise require
- Singapore company annual upkeep
- Getting money back to China legally
- Do you need a trademark
- What a GEO Technical Audit Checks
- How Often to Update Content for Freshness
- Using Reddit Without Getting Banned
- Getting YouTube Videos Cited by AI
- Building Brand Entity Signals
- Tracking Whether AI Cites You
- How Long Until AI Cites a New Site
- Article Structure That Gets Cited
- How Many Pages a Marketing Site Needs
- Writing the Privacy and Refund Policies
- The Three Speed Thresholds
- Optimising Images and Fonts
- Connecting Search Console and Analytics
- Pre-Launch Checklist
- Five Things That Break on Mobile
- Why Contact Forms Never Deliver
- Keeping Your Own Email Out of Spam
Domain and Cloudflare DNS
Your registrar only handles renewals; DNS should live at Cloudflare. Add a Site, pick the Free plan, then copy the two NS records Cloudflare gives you (like xxx.ns.cloudflare.com) back into your registrar under Nameservers, Custom DNS. Then in Cloudflare DNS, Records, add two entries: an A record with Name @ pointing at your host IP (216.198.79.1 for Vercel) and a CNAME with Name www pointing at the host target. Set SSL/TLS mode to Full, never Flexible, or you get an infinite redirect loop against the host's own HTTPS. Use Email Routing to forward support@yourdomain for free. Propagation is usually minutes to 24 hours. Verify with curl -I https://www.yourdomain and expect 200.
Hosting and real cost
A pure static site can run for nothing: Cloudflare Pages, Netlify and Vercel free tiers cover a marketing site comfortably, and a domain is about 10 USD a year. That is the entire fixed cost. WordPress needs PHP and MySQL, so free tiers do not apply; shared hosting runs 5 to 15 USD a month, and the cheap headline prices are usually prepaid for three years with a renewal that more than doubles. If you need a little server-side logic such as an AI proxy, a static host plus serverless functions is enough, you do not need a VPS. The classic beginner mistake is buying a 2.99 USD a month three-year plan that renews at 10.99 and cannot be cancelled.
Choosing the build approach
For a marketing site with a chat widget and a few endpoints, plain static is the least trouble: no build step, fast, cheap, and AI crawlers read the HTML directly. When you need auth, payment callbacks or an AI proxy, add a serverless layer (api/*.js) rather than adopting a framework. Reach for Next.js only when you genuinely need server rendering, heavy routing or thousands of dynamic pages. WordPress wins on visual editing and plugins but costs you speed, update maintenance and plugin conflicts. Site builders are the easiest to start and the hardest to leave. The real question is: who edits this site in six months.
Multilingual hreflang
Every language version needs the full set of rel="alternate" hreflang links in the head plus one x-default pointing at the default language, and they must be reciprocal: if A points at B, B must point back at A. One-way annotations do nothing. Canonical must be absolute and self-referential, and each language cluster should be cross-annotated in sitemap.xml. If translations live in a dictionary file, the iron rule is a two-file edit: the HTML data-i18n attribute and the matching dictionary key. Editing only the HTML gets overwritten at runtime. Crawlers do not run JS, so title, og:title and twitter:title must be in the static HTML, never injected later.
SEO hard thresholds
Title: best at 50-60 characters, truncated above 60, wasteful below 30. Meta description: best at 120-155 characters; it does not rank you directly but it decides click-through. Exactly one h1 per page and it must carry the core term — a brand slogan alone wastes the strongest signal you have. Canonical self-referential and absolute on every page. Put the Sitemap: line in robots.txt. Real lastmod values in sitemap.xml. Under 300 characters of visible body text counts as thin content and rarely gets cited. Any URL change needs a 301.
GEO in five steps
The order cannot be reversed: (1) technical foundation, can they fetch you; (2) content that is worth citing; (3) structured data, machine readable; (4) entity and brand signals, do they know you; (5) cross-platform monitoring, can you see it. If your technical and structured-data scores are under 60, fix those first and do not rewrite copy, because being unfetchable makes everything else moot. Google's own 2026 position is that optimizing for generative AI search is still SEO from Google's point of view, so crawlable, indexable, somewhat-ranked pages are the prerequisite. Citations come from extractable facts plus sources plus freshness, not from keyword density.
robots.txt and AI crawlers
Allow these user agents: GPTBot and OAI-SearchBot (OpenAI); ClaudeBot, anthropic-ai and Claude-SearchBot (Anthropic); PerplexityBot; Googlebot plus Google-Extended, which feeds Gemini and is separate from Googlebot; Applebot-Extended; and CCBot, Bingbot, Amazonbot, DuckDuckBot. User-triggered fetchers such as ChatGPT-User do not honour robots.txt at all; only server-side access control stops them. The biggest trap: robots.txt says Allow but Cloudflare's AI Scrapers rule blocks at the IP layer and returns 403 anyway. Verify by fetching with the actual user agent, never by reading your own robots.txt.
Content that gets cited
Measured gains from the Princeton KDD 2024 study, strongest first: citing sources on numeric claims (bold, link or reference marker) plus 115 percent citation rate; adding sourced statistics plus 40 percent visibility; adding expert quotations with name and title plus 41 percent. Fluency, author credentials and readability all help. Keyword stuffing hurts. Paragraph engineering: the most-cited passage length is 134 to 167 words and it must be self-contained, understandable out of context. About 44 percent of AI citations come from the first 30 percent of the page, so move conclusions up. Keep paragraphs under 80 words, use H2 and H3 as anchors, and prefer lists and tables to long prose. One sourced data point per 200 words, two to four attributed quotes per 1,000 words.
Structured data priority
By signal strength: FAQPage is the single strongest, 5 to 10 question-answer pairs, questions ending in a question mark, answers 30 to 200 words. Then Article with author credentials and dateModified; Organization with sameAs to Wikidata, LinkedIn and Crunchbase; then HowTo, Speakable, Product, BreadcrumbList, VideoObject with chapters, LocalBusiness. One type per page, one block, and a single JSON-LD syntax error kills the whole block. Validate in three places before deploying. Do not build on llms.txt. Google has said it is neither required nor a ranking gain, and in 2026 only about 0.1 percent of crawls request it. Fine to have, wrong to depend on.
How the AI platforms differ
ChatGPT draws 47.9 percent of its citations from Wikipedia and 11.3 percent from Reddit, and prefers authoritative long-form pages of 1,500 words or more with an unambiguous conclusion. Perplexity cites Reddit at 46.7 percent and favours numbered references and high source density. Claude wants precise attribution, fact density and content updated within 90 days. Google AI Overviews leans hard on pages that already rank, while AI Mode casts a wider net and weights freshness and entity authority; they agree on conclusions about 86 percent of the time yet cite the same URL only 13.7 percent of the time, so score them separately. Reddit and YouTube are the super-sources for overseas AI citations. 94 percent of cited YouTube videos are long-form and 40.83 percent of cited videos have under 1,000 views, which means structure beats view count. Add chapters.
Choosing a jurisdiction
For a first overseas storefront, Hong Kong is the default: no local director required, one person is enough, share capital of HKD 10,000 is subscribed not paid up, two-tier profits tax at 8.25 and 16.5 percent, no VAT and no capital gains tax, dividends not taxed, and major banks support remote video onboarding. Singapore requires at least one resident director, which adds roughly SGD 1,500 to 3,000 a year in nominee fees; corporate tax is 17 percent, GST 9 percent, and most banks want the director to appear in person. Highest running cost, best for Southeast Asia, fundraising or holding. A US LLC suits sellers focused on the US market doing over 100,000 USD a month who want lower fees. BOI beneficial ownership filing has been mandatory since 2025. Neither is a beginner's starting point.
Hong Kong: fees and process
2026 government fees: incorporation 1,545 HKD electronically (1,720 on paper, 1,280 refunded if refused); business registration 2,350 HKD for one year (2,200 fee plus 150 levy), 6,170 for three years; annual return 105 HKD; name change 295. Company secretary plus registered address runs about 2,000 to 5,000 HKD a year and is a private fee, not a government one. Process: name search (bring three to five options, English names must end in Limited, avoid reserved words such as royal, bank, trust, insurance), a licensed TCSP secretary prepares NNC1, the articles, the SCR and IRBR1, file through the e-Registry, certificate in one to three working days. You receive the CI, BR, NNC1, articles, company chop and SCR register. A company secretary must be a Hong Kong resident or a TCSP-licensed firm; it is not optional. Anyone quoting a few hundred yuan all-in is a risk that shows up later at renewal and can contaminate your payment accounts.
Hong Kong: annual return, audit, penalties
Annual renewal starts one month before the anniversary: BR renewal, annual return NAR1, secretary and address renewal. NAR1 is due within 42 days of incorporation, with escalating penalties in HKD: 870 at three months, 1,740 at six, 2,610 at nine, 3,480 beyond nine months. Serious cases lead to deregistration and frozen corporate accounts. Audit: the first profits tax return arrives 18 months after incorporation. If the company has bank transactions and real trading, an audit by a certified accountant is mandatory. Zero filing is only for shells that never had an account. Filing zero while money moved is a violation, penalties start in the tens of thousands of HKD, and the bank account can be closed. The SCR significant controllers register must be filed within 30 days of incorporation; failure carries a fine up to 10,000 HKD and possible prosecution.
Business bank account
Remote-friendly institutions for a Hong Kong company: HSBC business (video plus mainland witnessing lawyer), BOCHK (online pre-check plus Shenzhen or Guangzhou branch), Standard Chartered (Zoom due diligence, needs mainland operating proof), DBS (limited to companies with a Hong Kong or Singapore resident director), and virtual banks such as WeLab (fully online, Hong Kong companies only). Documents: CI and BR scans, NNC1 or latest NAR1, articles, all directors' and shareholders' ID plus travel permit, three months of address proof for the ultimate beneficial owner (utility bill or bank statement, name and address matching, screenshots refused), and a business case covering main activity, customer and supplier countries, projected turnover and payment methods. Three common rejection causes: the business description does not match the company structure; address proof is stale or the name spelling drifts; in the video interview you cannot explain operating location, server location and goods flow consistently. After approval, fund the account within 7 to 14 days (5,000 to 50,000 HKD) or it may be frozen. Twelve months without transactions pushes it dormant.
Taking payments: Stripe, PayPal, the three documents
Three routes. Mainland company direct: approved in one to three days, from 3.4 percent, medium risk, fine to validate. Hong Kong company: three to seven days, from 3.4 percent, lowest risk, highest limits, free payouts, best long term. US LLC with EIN: one to two weeks, 2.9 percent plus 30 cents, best for large US volume. A Stripe business account requires an overseas entity as the account holder. Three documents are mandatory and their absence alone triggers review: Privacy Policy with GDPR and CCPA clauses, Terms of Service, and Refund Policy such as 30-day no-questions returns. They must be live pages on the site, not files in a drawer. Register PayPal Business under the Hong Kong company; it is more stable than a personal or mainland account and complements Stripe.
Six risk rules that keep accounts alive
One: have the site live with 30 or more real orders, collected through PayPal if needed, before applying to Stripe; approval rates roughly double. Two: no high-ticket cold start; keep the first month's single order size modest and volume under 5,000, scale in month two. Three: tracking numbers must be real and traceable; fake or missing tracking is instant closure. Four: hold chargebacks under 0.75 percent; above 1 percent Stripe freezes the account. Five: stay out of prohibited categories such as adult, vaping, CBD and some supplements; Stripe collects first and reviews later. Six: one entity, one Stripe account; shared IP, device or payout card links accounts and takes them all down together.
Mainland-side tax compliance
Under China's individual income tax law, anyone with a domicile, or present 183 days in a tax year, must declare worldwide income. Business income, dividends, equity transfer gains and deposit interest all count. CRS: China automatically exchanges financial account information with over 100 jurisdictions. Accounts you open in Hong Kong, Singapore or the US are reported back and matched against your filings. Assuming the tax authority cannot see offshore income is an outdated bet. ODI: a mainland entity investing abroad must file or obtain approval through the NDRC, the commerce department and SAFE. If Hong Kong profits are to be repatriated, ODI filing has to be done. CFC: setting up in a low-tax jurisdiction with no genuine operations and leaving profits undistributed can be treated as deemed distribution and taxed. Do not treat the Hong Kong company as a money box that only collects. Enforcement runs five steps: reminder, rectification notice, warning interview, investigation, public exposure.
US LLC and Singapore
US LLC: Wyoming suits ecommerce, no state income tax, strong privacy, annual report plus franchise tax from 60 USD. You need a registered agent at about 100 to 200 USD a year, file Articles of Organization for about 100 USD, then obtain an EIN on Form SS-4; a non-resident without an SSN can file by paper or fax, and the EIN is the hard prerequisite for a US bank account and Stripe US. BOI beneficial ownership reporting has been mandatory since 2025 and the rules have shifted, so check FinCEN before acting. Remote banking: Mercury, Relay, Wise, Brex. Pure shells with non-resident owners get rejected. Budget from about 700 USD plus annual state fees. Singapore: ACRA registration in one to three days, government fee around SGD 315, resident director and licensed secretary mandatory, annual upkeep roughly SGD 3,000 to 6,000.
When a payment account is frozen
We have no first-hand case history here, so we give direction only. We do not file appeals for you and we do not sell a promise of reinstatement. General path: in the Stripe dashboard read the notice and the Requirements page, then submit exactly what is listed, typically business licence, CI and BR, supplier contracts, tracked shipping, screenshots of the three policy pages, and refund records. On PayPal, respond through the Resolution Center and supply the business proof requested. Appeals usually take 3 to 14 days and you can resubmit once with more evidence if the first attempt is refused. Do three things in parallel: get the three policy pages live, bring the chargeback rate down, and add a second payment channel so Stripe is not your only door. If you are running paid traffic, pause it while the dispute count is still climbing.
Hong Kong incorporation: documents and turnaround
You file three documents: Form NNC1, the Articles of Association, and Notice to the Business Registration Office IRBR1, plus each director's ID or passport and proof of address under three months old (utility bill or bank statement, no screenshots). Name search on the Companies Registry site is free; shortlist three to five names ending in Limited. Filing through e-Registry issues the electronic certificate in about 1 hour for a private company, versus about 4 working days on paper. Government fee is HK$1,545 electronic or HK$1,720 on paper.
Hong Kong company: fixed annual cost
Four fixed items every year: business registration fee HK$2,350 (HK$2,200 fee plus HK$150 levy, one-year certificate), annual return HK$105 if filed within 42 days of the anniversary date or from HK$870 once late, company secretary plus registered office around HK$2,000 to HK$5,000, and the statutory audit priced by transaction volume. Budget about HK$9,000 to HK$12,000 a year in total. The first two go to the government, the other two to your secretary firm and accountant. A dormant company still pays both.
Hong Kong business bank accounts compared
HSBC runs video signing plus a mainland witness lawyer. BOCHK pre-screens online, then you sign at its Shenzhen or Guangzhou branch. Standard Chartered does Zoom due diligence and wants mainland tax or lease proof. DBS only takes companies with a Hong Kong or Singapore resident director. WeLab and other virtual banks are fully online but Hong Kong-incorporated only. Hang Seng and ZA Bank are similar, so check each. Activate within 7 to 14 days with a first deposit of HK$5,000 to HK$50,000; monthly fees and minimum balances follow each bank's terms.
Stripe fees and payout routes
A Hong Kong entity pays about 3.4% and up, with approval in 3 to 7 days. A US LLC with an EIN pays 2.9% plus $0.30, approved in 1 to 2 weeks. A mainland company can also connect at 3.4% and up within 1 to 3 days, but risk review is stricter. Payouts only reach the Hong Kong bank account bound in your name, never a mainland personal card; moving money home means dividends or service fees plus ODI filing. Stripe opens merchant accounts only where a local entity is supported, and Hong Kong and the US both qualify.
Why a new PayPal account gets reviewed
New accounts often hit an automatic review on the first few payments, and funds sit on hold, commonly around 21 days, with the exact release date shown in your account notice. The Resolution Center will ask for proof of shipment, traceable tracking numbers, supplier invoices, your website link and the three policy pages. To reduce reviews: register as a Hong Kong company, launch the site before selling, upload real tracking right after shipping, and avoid a sudden spike in order value. Seller Protection covers only eligible item-not-received and unauthorised claims.
Which US state for an LLC
Wyoming suits a one-person store best: no state income tax, members not public, annual report plus franchise tax from $60, and a registered agent is mandatory at roughly $100 to $200 a year. Delaware has no state income tax but steep franchise tax for C corps, so it fits venture funding. Nevada offers good privacy with mid-range fees. All three need Articles of Organization, about $100 to file. Late annual reports stack penalties, and lapsed registered agent service can get the company administratively dissolved.
Getting an EIN without an SSN
You can still get an EIN without an SSN, just not online: file Form SS-4 by mail or fax to the IRS, or hand it to an agent. Processing follows the IRS acknowledgement, typically about 4 to 8 weeks, with fax usually faster than post. Put your passport details in the responsible party section and mark yourself as a foreign person. The EIN is the hard prerequisite for a US business bank account and Stripe US. An ITIN is a personal tax number and cannot replace an EIN.
What Mercury, Relay and Wise require
All three open remotely. You need the LLC formation documents, the EIN, the director's passport and proof of business: what you sell, where buyers and suppliers sit, expected annual volume, and your website link. A registered agent address usually works as the US address, but real trading activity backs the account. Mercury tightened rules for non-residents in 2025; pure shells, dormant accounts and descriptions that contradict the website are the three usual rejections. Relay and Wise handle multi-currency; Wise suits collecting several currencies then paying overseas suppliers.
Singapore company annual upkeep
The costly part is the mandatory resident director: a nominee director runs about S$1,500 to S$3,000 a year, and with a licensed secretary, local registered address and annual return filing the total lands near S$3,000 to S$6,000. The ACRA registration fee is about S$315. Each year you must hold an AGM and file the annual return or face penalties, and register for GST at 9% once turnover passes S$1 million. Corporate tax is 17%, with 75% exemption on the first S$100,000 of chargeable income for the first three years.
Getting money back to China legally
Three routes. First, the Hong Kong company pays dividends out of audited after-tax profit, and repatriating into a mainland entity requires ODI filing before conversion. Second, the mainland company charges the Hong Kong company service fees or royalties, backed by real contracts, pricing rationale and invoices, never invented flows. Third, the personal USD 50,000 annual facilitation quota covers current-account items only, so it cannot fund an offshore company or pull profit home. Underground banks, split transfers and fake trade backgrounds are all violations.
Do you need a trademark
Registering a company name is not a trademark. The Hong Kong Companies Registry only handles company names; trademarks go to the Trade Marks Registry separately. In the US you file with the USPTO per class, roughly $250 to $350 per class, taking about 8 to 14 months. Selling on Amazon needs a registered mark for Brand Registry, which unlocks A+ content and anti-hijacking tools. Without one, a competitor can register your name first, then report you for infringement and get listings pulled or stock held.
What a GEO Technical Audit Checks
Run the audit script twice: the robots check fetches your page as GPTBot, ClaudeBot and PerplexityBot, and only a 200 counts as passing, because an Allow line still returns 403 when Cloudflare's AI bot rules block at the IP layer. Then verify six items by hand: real copy in the first HTML response, a truthful sitemap lastmod, a self-referencing canonical, reciprocal hreflang, LCP under 2.5 seconds, and JSON-LD passing both Rich Results Test and the Schema.org validator. Recheck every 30 days, and fix technology before copy whenever scores fall below 60.
How Often to Update Content for Freshness
Content published or refreshed within 30 days is roughly 3.2x more likely to be cited; after six months without substantive edits a page largely loses eligibility, and Claude favors pages showing a last-updated date inside 90 days. Refreshing is not editing the date: add a statistic from the past quarter, add one or two attributed quotes, rewrite the conclusion, then sync dateModified in JSON-LD with the visible Last updated line so they match. Any page older than 90 days with no new citations triggers a refresh. Remove duplicate pages targeting the same intent and thin pages under 300 characters, merging duplicates with 301s.
Using Reddit Without Getting Banned
Reddit carries outsized weight in AI answers: 46.7% of Perplexity citations come from Reddit, 11.3% of ChatGPT's, and Google's Community Perspectives now surfaces forum threads. The only durable method is genuine participation. Read each subreddit's rules before posting; most require minimum account karma and age, thresholds vary per community, so never drop links from a fresh account. Write titles as questions or experience posts rather than product names plus discounts. Typical ban triggers are a high self-promotion ratio, the same link posted across several subreddits, and marketing language in titles. Put links in the body and explain why they are relevant.
Getting YouTube Videos Cited by AI
94% of YouTube videos cited by AI are long-form, and 40.83% of cited videos have fewer than 1,000 views, which means structure decides citations and audience size does not. Three required steps: open the description with the answer in the first sentence or two instead of a subscribe pitch; add chapter timestamps and ship VideoObject, Clip and SeekToAction schema so chapters map to exact seconds; upload captions, because models read the transcript. Titles just need the question phrasing and the core entity, since there is no documented ideal character count, so do not force 60 characters.
Building Brand Entity Signals
Entity work sits fourth because the first three steps only make you crawlable, citable and machine-readable, while a model still has to recognize who you are before naming you. Ahrefs studied 75,000 brands and found brand mentions correlate with AI visibility three times more strongly than backlinks. Four moves: create a Wikidata item for a Q ID, which clears review more easily than Wikipedia, so start there; complete Crunchbase and the LinkedIn company page; open Google Business Profile if you serve a local area; keep name, address and phone identical everywhere. List those URLs in Organization sameAs, and use the brand name in 50–60% of anchor text.
Tracking Whether AI Cites You
Pick 5–10 core questions each week and ask them in ChatGPT, Perplexity, Google AI Overviews, Claude and Copilot with one fixed prompt: which sites would you cite for this query. That keeps results comparable. The free stack is manual logging plus analytics: tag landing pages with ?utm_source=ai&utm_medium=chatgpt and read the ai/* channel for sessions and conversions. Scale later with Peec AI, OtterlyAI, Scrunch AI or Profound. When a citation appears, refresh that page's date and republish the same fact elsewhere, because AI Overviews and AI Mode share only 13.7% of cited URLs.
How Long Until AI Cites a New Site
Expect 60 to 90 days before meaningful movement, on a cadence of 30 days for technical fixes, 90 for content clusters and 180 for entity signals. Systematic GEO work produced roughly a 30–40% lift in selection rate in GEO-bench testing, a lab figure rather than a guarantee. A brand-new site usually sees zero citations in month one, because 92% of AI Overviews citations come from pages already ranking in Google's top 10. Anyone promising a ChatGPT recommendation within a week is selling fiction. Hardest cases are competitive commercial terms and brands with no press coverage: 84% of AI citations come from earned media, so owned content alone has a ceiling.
Article Structure That Gets Cited
Answer the query in the first 40–60 words, then a three-sentence TL;DR carrying one sourced statistic. Use 4–6 H2s as anchors across 1,500+ words, the long-form consensus format ChatGPT leans toward. Place one sourced data point every ~200 words and 2–4 attributed quotes per 1,000 words; keep key paragraphs 134–167 words and self-contained, cap paragraphs at 80 words, and prefer tables over prose. Run 3–5 real FAQs in the body and up to 5–10 pairs in FAQPage schema. Skip the hard pitch: close with the last-updated date, author credentials, and an ask to add the site as a Preferred Source in Google.
How Many Pages a Marketing Site Needs
A site that can take orders needs about eight pages: a homepage saying who you are and what you solve; a service or product page stating what is delivered; a separate Pricing page with price and currency; an About page with real people and real photos for trust; Contact with an email and a form; an FAQ to absorb repeat questions; Privacy Policy, Refund Policy and Terms, which payment review actually reads; plus a 404. The privacy and refund pages are non-negotiable; About and FAQ can start merged. A homepage with under 300 characters of readable text reads as thin, which hurts both search and AI citation.
Writing the Privacy and Refund Policies
The privacy policy must state what you collect (email, payment data, cookies), who receives it (Stripe, PayPal, Google Analytics), how long you keep it, and how a visitor asks for deletion. The refund policy must state the refund window in days, which cases qualify, how many days the money takes to return, and where to apply. Stripe and PayPal review mainly check four things: Privacy, Refund and Terms pages that actually load, a support email that answers, a registered entity name and address, and prices with an explicit currency. Missing pages or obviously copied text gets flagged as high risk or rejected outright.
The Three Speed Thresholds
Speed is judged on three Core Web Vitals lines: LCP good under 2.5 seconds, poor past 4; INP good under 200 milliseconds, poor past 500; CLS good under 0.1, poor past 0.25. Test on mobile in PageSpeed Insights or Lighthouse, not the desktop score, which can be twice as good. Fix LCP first: compress the hero image, remove render-blocking scripts and fonts, then check host response time. CLS is usually images without width and height; INP is usually too much JavaScript. Change one thing, then retest.
Optimising Images and Fonts
Convert images to WebP first: roughly 25 to 35 percent smaller than JPEG at the same quality, and AVIF goes further. Keep the hero image around 200KB, thumbnails in the tens of KB, and always set width and height so nothing jumps. Fonts are the number one cause of a slow first screen: a Chinese font file can run several megabytes and blocks rendering. Keep only 2 weights, use woff2, subset to the characters you actually use, add font-display: swap so text paints in a system font first, then preload that one file.
Connecting Search Console and Analytics
Verify Search Console with a DNS TXT record rather than a meta tag: it survives template changes. Uploading an HTML file to the root works too. Then watch three numbers: pages reported as indexed under Pages, impressions and clicks under Performance, and how many URLs turn red in the Core Web Vitals report. In GA4, put the Measurement ID (formatted like G-XXXXXXXXXX) in the head, deploy, then open Realtime to confirm your own visit shows up. Check indexing daily for the first two weeks, then weekly. Do not refresh rankings every day.
Pre-Launch Checklist
Does it open: the main domain returns 200, apex redirects to www with a 308, and the response header reads x-vercel-cache: MISS right after deploy. Does it have content: every page title is 30 to 60 characters, exactly one H1, no stray noindex, and at least 300 characters of body text. Can it be found: a self-referencing canonical, a reachable sitemap.xml and a robots.txt with a Sitemap: line, reciprocal hreflang with x-default. Can it take money: run one small real payment, and have the refund page and currency in place. Can it be contacted: send the form to your own inbox and get a reply from support.
Five Things That Break on Mobile
Check five things on a phone: whether the hamburger menu opens in one tap, and whether every tap target is at least 44×44 px; body text no smaller than 16px, because iOS zooms the whole page when an input is under 16px; buttons also 44px tall, not stacked on top of each other; horizontal scrolling, which usually means a fixed width, a wide table or an image without max-width; and forms with type="email", type="tel" and autocomplete so the right keyboard appears. Test on a real phone in portrait, not a narrowed browser window.
Why Contact Forms Never Deliver
Three fields are enough: name, email, message. Every extra field costs submissions, so make subject a dropdown instead. For spam, prefer a hidden honeypot field or Cloudflare Turnstile over image puzzles, which visibly kill mobile conversions. If mail never arrives, check in this order: the spam folder, a mistyped recipient, whether the endpoint actually returned success, whether the host only wrote to a database without sending, and whether SPF and DKIM are configured. Most broken forms show a success message while nothing is sent, so enquiries vanish silently.
Keeping Your Own Email Out of Spam
Three records make authentication work. SPF is one TXT record (like v=spf1 include:... -all) naming the servers allowed to send for you; only one is permitted, and the whole chain must stay under 10 DNS lookups. DKIM publishes a public key at selector._domainkey and signs every message. DMARC lives at _dmarc: start with v=DMARC1; p=none plus a rua address to collect reports, then move to quarantine after two clean weeks. Default host sending gets filtered because of shared IP reputation, missing signatures, and a From domain that does not match SPF.