#Production Performance Checklist¶

Before flipping the switch to prod, walk through this list. Each item is a 5-minute check that prevents a 5-hour incident.

Build-Time Checks¶

• next build runs without warnings (treat warnings as errors)
• Bundle analyzer shows no unexpected large chunks
• No console.log statements remain (lint or strip with babel)
• Source maps are uploaded to Sentry / your APM but not served publicly

Configuration¶

1// next.config.ts
2const config: NextConfig = {
3  poweredByHeader: false,
4  reactStrictMode: true,
5  productionBrowserSourceMaps: false,
6  compiler: { removeConsole: { exclude: ["error", "warn"] } },
7  experimental: {
8    optimizePackageImports: ["lucide-react", "date-fns"],
9  },
10  async headers() {
11    return [
12      {
13        source: "/(.*)",
14        headers: [
15          { key: "X-Content-Type-Options", value: "nosniff" },
16          { key: "X-Frame-Options", value: "SAMEORIGIN" },
17          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
18        ],
19      },
20    ];
21  },
22};

Core Web Vitals Targets¶

Measure with PageSpeed Insights, Vercel Speed Insights, or Lighthouse on a throttled 4G profile.

LCP Wins¶

1. 1priority on the hero image — adds it to the preload list
2. 2Self-hosted fonts via next/font — no DNS lookup
3. 3Server-render the LCP element — no waiting on hydration
4. 4CDN-cached HTML for the entry page — PPR if dynamic

INP Wins¶

1. 1Less client JS — push more to the server
2. 2Break up long tasks — startTransition for non-urgent updates
3. 3Lazy-load heavy widgets — dynamic(() => import("Chart"))
4. 4Avoid hydration storms — small Client Components, big Server tree

Database¶

• Connection pooling enabled
• Slow query logs on
• Indexes on every WHERE / ORDER BY column
• No N+1 queries (use include / select to eager-load)

Observability¶

Security¶

• CSP header set (start with Report-Only)
• HTTPS enforced (HSTS header)
• Rate limit on auth endpoints
• Dependency scan in CI (npm audit --omit=dev)
• Secrets in env vars only — nothing in git
• CSRF protected (Server Actions handle this; route handlers need explicit checks)

Pre-Launch Smoke Tests¶

1. 1Cold load: incognito, throttled to 4G, LCP must be under 2.5s.
2. 2Auth flow: signup → login → logout → re-login. Cookies expire correctly.
3. 3Payment flow (if any): full Stripe test card path including webhook fulfillment.
4. 4Recovery: kill the app server while a request is in flight — graceful 5xx, not a hang.
5. 5DB outage: stop the database, page should show a graceful error, not crash the process.

Post-Launch¶

• Monitor Sentry for the first 24h closely
• Watch p50/p95 latency in your APM
• Run a small chaos test in week 2 (kill an instance, see if traffic survives)
• Re-run Lighthouse weekly to catch regressions early