I'd add rate-limits. They need to be tested, but once working, it tremendously helps managing the site load, especially with regards to malicious scarpers/crawlers.

I've been maintaining this pre-launch checklist for my own projects, mixing general best practices with lessons learned from my own past mistakes (like session issues, caching pitfalls, unexpected browser behavior, etc).

I decided to clean it up and publish it hoping it might help others avoid the same pitfalls.

I know this list isn't exhaustive. What are some "must-checks" you always perform before launching a web app that I might have missed?

I'd love to learn from your experiences.