What should I check before launching a Lovable website?

Run through security, forms, auth, payments, mobile display, browser compatibility, speed, SEO basics and broken links before you hit Publish.

How do I test mobile devices?

Open the published site on a real phone (or use your browser's device toolbar as a fallback) and check layout, tap targets, forms and navigation at common breakpoints.

Submit every form with valid, invalid and empty data, confirm error messages appear, and check that submitted data actually lands where it should (database, inbox or integration).

How do I test password reset?

Request a reset with a real account, confirm the email arrives with a working link, complete the reset, and confirm the old password stops working and the reset link can't be reused.

How do I test payments?

Run a real Stripe test-mode transaction end to end — checkout, webhook, database update and confirmation email — before switching to live keys.

How do I test admin permissions?

Log in as a non-admin account and try to reach every admin action directly (URLs, buttons, API calls) to confirm the server — not just the UI — blocks it.

Try reading and writing data as a different logged-in user and as a logged-out visitor to confirm row-level security actually blocks what it should, rather than assuming the policy is correct.

Check that every page has a unique title and meta description, images have alt text, the site generates a sitemap, and preview the page as a search engine or social share would see it.

How do I test website speed?

Run the published (not local) URL through a tool like Google PageSpeed Insights or WebPageTest, and check real load times on mobile data, not just your fast office wifi.

How do I test different browsers?

Open the published site in at least Chrome, Safari and Firefox on both desktop and mobile, and check layout, forms and any browser-specific features work in each.

How do I check for broken links?

Click through every nav item, footer link and CTA yourself, or ask Lovable to list every link on the site so you can verify each one resolves before launch.

How do I check for console errors?

Open your browser's developer console on every key page of the published site and look for red error messages — then ask Lovable to fix each one by name.

How do I back up my project before launch?

Bookmark the current state in Version history, and push to a connected GitHub/GitLab repo via Git sync so you have a full backup outside Lovable too.

How do I test my Lovable app?

Q: How do I test user registration?

Sign up with a real and a duplicate email, confirm verification emails arrive, check password rules, and confirm a new account only gets the access it should.

Last checked 31 Aug 2026

Short answer

Work through core user flows manually in Preview and on a published link, on desktop and mobile, as a logged-out user and as a normal account — not just as the builder.

Why manual testing still matters

Lovable's built-in scans catch code-level security issues, but only you know what your app is supposed to do. Testing means walking through the app as a real visitor would, deliberately trying to break things.

A practical order

Use the Preview with the preview toolbar to click through every page and interactive element.
Test as a logged-out visitor — confirm protected pages redirect to login and don't leak data.
Test as a normal user account — not the account you built the app with, which may have implicit extra access.
Test every form — see /questions/how-do-i-test-forms.
Test auth — registration, login, logout, password reset.
Test payments in a real (or Stripe test-mode) flow if you charge money.
Check mobile on an actual phone, not just a resized browser window.
Check the browser console for errors on every page you visit.
Publish to a preview/staging URL first if possible, and repeat the pass there — local Preview and the published build can behave differently (e.g. environment variables, caching).

A prompt for a guided walkthrough

List the main user flows in this app (sign-up, [feature], checkout, etc.) so I can test each one manually before launch.

What usually goes wrong

Only testing the "happy path" — never trying an invalid email, an empty required field, or double-clicking a submit button.
Testing exclusively as the admin/builder account, which hides permission bugs.
Skipping mobile testing because the desktop preview looks fine.
Not testing on the actual published domain, where CORS, redirects or env config can differ from Preview.

For a structured pass on any specific area, see /questions/how-do-i-test-forms, /questions/how-do-i-test-user-registration and /questions/how-do-i-test-rls.

Sources

Security best practices for Lovable apps

Was this answer helpful?