Deploy failures cluster around a handful of root causes: an env mismatch between dev and prod, DNS that hasn’t propagated, a CDN still serving stale assets, and a rollback nobody rehearsed. These 12 prompts surface the usual suspects before they ship, then give you a structured first-24-hours watch so a regression doesn’t sit unnoticed for a day. Paste them into any model with a current cutoff (Claude Sonnet 4.6, GPT-5.5, or Gemini 3.1 Pro all handle this well as of June 2026), fill in the [bracketed] placeholders, and you get stack-specific output instead of generic advice. Pair this with Claude Code execution prompts for the build side.
TL;DR
- Run prompts 1–4 (checklist, env diff, DNS, cache) before the deploy; 5–7 (smoke test, observability, rollback) during the cutover; 8–12 (24h watch, headers, hreflang, comms, post-mortem) after.
- The two cheapest deploy insurance policies: an env-var diff (catches half of all “works locally” failures) and a rollback drill you’ve actually run once.
- Lower your DNS TTL to 300s a full 24–48h before any domain cutover, then verify with
digand whatsmydns.net before flipping records. - Grade your security headers free at securityheaders.com after launch; aim for A or better.
Best for
- First production deploy of a new project
- Major version release with breaking changes
- Custom domain migration between DNS providers
- Hosting platform switch (e.g., Firebase Hosting to Vercel)
- Site-wide infrastructure changes (CDN, image host, DNS)
- Releases that touch billing, auth, or anything load-bearing
1. Pre-launch checklist
My stack: [framework + hosting, e.g. Astro on Vercel Pro].
Generate a pre-launch checklist tailored to this stack:
- build (commands, env, output dir)
- env vars (required, optional, secret-store reference)
- DNS, SSL (certs, redirects, www vs apex)
- sitemap, robots.txt, canonical
- analytics, error tracking, real-user monitoring
- AdSense / monetization status (if applicable)
- legal pages, privacy, cookie banner
Max 25 items. Mark each as blocking or non-blocking.2. Env-var diff check
Below are env-var lists for dev + prod. Identify:
- missing in prod that the code requires
- mismatched values likely to break (URLs pointing to the wrong env,
feature flags inverted)
- present in prod but no longer used in code
- secrets exposed in non-secret env files
[paste both lists]
Output: 4 lists with severity tags (blocker / warn / cleanup).This single prompt catches the most common deploy failure of all: a value that exists locally in .env but was never added to the host’s secret store.
3. DNS migration plan
Migrating domain [domain] from [provider A] to [provider B].
Plan:
- TTL pre-lower steps and timing (drop to 300s, start 24-48h before)
- Full list of records to recreate (A, AAAA, CNAME, MX, TXT, CAA)
- Order of operations during the cutover
- Rollback path (and the TTL window that allows it)
- Verification commands (dig, nslookup, whatsmydns.net)
- TTL restore step after 48h of confirmed stabilityConcrete timing: with TTL at 300s, most resolvers worldwide return the new record within 30–60 minutes; the old 24–48h horror stories come from sites that left TTL at 3600s+ and never lowered it. Verify the lower TTL actually propagated before you touch the records:
dig +noall +answer [domain]The number in the TTL column should read 300 or lower before you cut over.
4. Cache invalidation plan
Deploying changes that affect cached assets / pages.
List:
- layers I need to invalidate (CDN, edge, framework page cache,
browser via Cache-Control headers)
- expected propagation time per layer
- which assets are safe to keep cached
- verification commands for each layer
- fallback if invalidation is slow (purge-by-tag, version-bump asset URLs)5. Smoke-test script
Generate a 10-step smoke-test script for [site] to run post-deploy:
1. homepage loads (200, no console errors)
2. a key article / detail page
3. sitemap.xml valid + lists expected URLs
4. robots.txt allows production crawl
5. 404 page works
6. login flow (if any)
7. API health endpoint
8. RSS feed (if applicable)
9. hreflang correctly cross-links languages
10. mobile layout doesn't break above the fold
Each step: command or URL + expected result + how to log failure.6. Observability check
For [stack], list the minimum observability I should have before launch:
- error tracking (frontend + backend)
- structured logging
- uptime monitor (external)
- real-user metrics (Web Vitals, conversion)
- alert routing (where alerts land, on-call rotation)
Suggest free-tier tools per category and the 5-minute setup for each.Free-tier picks that hold up at launch scale (as of June 2026): Sentry (free tier covers 5,000 errors/month, unlimited team members) or Better Stack (free tier ~100k exceptions/month, no card, bundles uptime + status page) for error tracking; Better Stack or UptimeRobot for external uptime; and Vercel/Cloudflare built-in Web Vitals for real-user metrics. See Sentry’s pricing before you scale past the free tier.
7. Rollback drill
For my stack [framework + hosting], design a rollback procedure:
- code rollback (git revert vs previous-deploy promote)
- DB migration rollback (forward-only? down-migration? feature flag instead?)
- DNS rollback (TTL constraints)
- cache invalidation after rollback
Document the exact commands. Add a "who has access" line per step.On Vercel, code rollback is the fast path: Instant Rollback repoints production traffic to a prior deployment at the routing layer with no rebuild, so it lands in seconds (vercel rollback from the CLI, or the Production Deployment tile in the dashboard). Two gotchas worth knowing before the outage: Hobby plans can only roll back to the immediately previous deployment (Pro/Enterprise can pick any past production deploy), and a rollback uses the old env vars and cron config, not whatever you’ve since changed in settings. See Vercel’s Instant Rollback docs.
8. Post-launch 24h monitor plan
First 24h post-launch: what to watch and when.
For each metric, give:
- threshold that triggers attention
- first action when threshold is hit
- escalation path if first action doesn't resolve
Metrics: error rate, p95 latency, Search Console errors, hosting platform
alerts, AdSense / monetization status, conversion vs baseline.9. Security header audit
For [site URL], draft a security header set:
- Content-Security-Policy (tight default + necessary allowances for
analytics, AdSense, fonts)
- Strict-Transport-Security
- X-Frame-Options / frame-ancestors
- Referrer-Policy
- Permissions-Policy
Output: the exact header config for [hosting platform] + verification
command (curl -I).Sane starting values: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload (two years) and a strict CSP like default-src 'self'; frame-ancestors 'none'; base-uri 'self', then widen only for the domains analytics and AdSense actually need. After you ship, scan the live URL at securityheaders.com and aim for an A. The OWASP Secure Headers Project is the authoritative reference for what each header does.
10. Hreflang / i18n verification
My site has [N] languages: [list]. For each page type
([homepage, article, category]), verify:
- hreflang tags cross-link all language variants
- x-default points to the right page
- canonical does NOT cross languages
- sitemap has language-specific entries
- 1 example URL per language to spot-check
Output: a verification checklist + the exact URLs to manually test.11. Status page + incident comms templates
Draft 4 status page / incident comm templates for [site]:
1. Investigating - first 10 min of an incident
2. Identified - root cause known, fix in progress
3. Monitoring - fix deployed, watching for stability
4. Resolved - full post with timeline, root cause, follow-ups
Each under 200 chars in the status update + a longer email version.
Voice: calm, factual, no blame.12. Post-incident root-cause prompt
We had an incident: [one-line description, duration, user impact].
Walk me through a structured post-mortem:
1. Timeline of events (detection -> mitigation -> resolution)
2. Direct cause vs root cause vs contributing factors
3. What worked in the response
4. What we should change (process, code, observability)
5. Action items with owners and due dates
Output: a fill-in template I can paste into the post-mortem doc.When to run each prompt
| Phase | Prompts | Goal |
|---|---|---|
| Before deploy | 1 Checklist, 2 Env diff, 3 DNS, 4 Cache | Catch config gaps while they’re cheap |
| During cutover | 5 Smoke test, 6 Observability, 7 Rollback | Verify live, keep an escape hatch ready |
| First 24h | 8 Monitor, 9 Headers, 10 Hreflang | Watch for silent regressions |
| If it breaks | 11 Comms, 12 Post-mortem | Communicate, then learn |
Common mistakes
- No env-var diff before deploy. Half of all “it works locally” failures land here, and prompt 2 catches them in seconds.
- Skipping the cache invalidation plan. Users see the old version for hours and file bug reports for a build you already shipped.
- No rollback drill before launch. Rollback gets debugged for the first time during the outage, which is the worst possible moment to discover your Hobby plan only keeps one prior deploy.
- Watching only error rate post-launch. Conversion regressions silently outlast a quiet error log; track conversion vs baseline too.
- Forgetting the hreflang check on i18n sites. Google indexes one language and ignores the rest.
FAQ
Which model should I paste these into? Any current model handles deploy reasoning well. As of June 2026, Claude Sonnet 4.6 and GPT-5.5 are strong defaults; if you want the output checked against your actual repo, run it inside Claude Code or Cursor so the model can read your config files rather than guessing.
How far before a DNS cutover should I lower the TTL?
At least 24–48 hours. Drop the record’s TTL to 300 seconds, confirm with dig +noall +answer [domain] that the lower value has propagated, then do the actual record swap. After 48 hours of confirmed stability, raise the TTL back to 3600s+ to cut query load.
Do I really need a rollback drill if I’m on Vercel with Instant Rollback? Yes. Instant Rollback covers your code in seconds, but it does not undo database migrations, and on Hobby plans it can only return you to the single previous deployment. The drill is mostly about the parts Instant Rollback doesn’t touch: migrations, DNS, and cache.
What’s the fastest way to verify my security headers after deploy?
curl -I https://yoursite.com for a quick look, then paste the URL into securityheaders.com for a graded report. Aim for an A; the most common miss is a missing or overly loose Content-Security-Policy.
Can I run all 12 in one conversation? You can, but you’ll get sharper output running them in their phase groups (before / during / after) with the relevant context pasted each time. Lumping all 12 into one prompt dilutes the model’s attention and tends to produce shallower checklists.