What should I check before launching a Lovable website?

Run through security, forms, auth, payments, mobile display, browser compatibility, speed, SEO basics and broken links before you hit Publish.

How do I test my Lovable app?

Work through core user flows manually in Preview and on a published link, on desktop and mobile, as a logged-out user and as a normal account — not just as the builder.

How do I test mobile devices?

Open the published site on a real phone (or use your browser's device toolbar as a fallback) and check layout, tap targets, forms and navigation at common breakpoints.

Submit every form with valid, invalid and empty data, confirm error messages appear, and check that submitted data actually lands where it should (database, inbox or integration).

How do I test user registration?

Sign up with a real and a duplicate email, confirm verification emails arrive, check password rules, and confirm a new account only gets the access it should.

How do I test password reset?

Request a reset with a real account, confirm the email arrives with a working link, complete the reset, and confirm the old password stops working and the reset link can't be reused.

How do I test admin permissions?

Log in as a non-admin account and try to reach every admin action directly (URLs, buttons, API calls) to confirm the server — not just the UI — blocks it.

Try reading and writing data as a different logged-in user and as a logged-out visitor to confirm row-level security actually blocks what it should, rather than assuming the policy is correct.

Check that every page has a unique title and meta description, images have alt text, the site generates a sitemap, and preview the page as a search engine or social share would see it.

How do I test website speed?

Run the published (not local) URL through a tool like Google PageSpeed Insights or WebPageTest, and check real load times on mobile data, not just your fast office wifi.

How do I test different browsers?

Open the published site in at least Chrome, Safari and Firefox on both desktop and mobile, and check layout, forms and any browser-specific features work in each.

How do I check for broken links?

Click through every nav item, footer link and CTA yourself, or ask Lovable to list every link on the site so you can verify each one resolves before launch.

How do I check for console errors?

Open your browser's developer console on every key page of the published site and look for red error messages — then ask Lovable to fix each one by name.

How do I back up my project before launch?

Bookmark the current state in Version history, and push to a connected GitHub/GitLab repo via Git sync so you have a full backup outside Lovable too.

How do I test payments?

Last checked 31 Aug 2026

Short answer

Run a real Stripe test-mode transaction end to end — checkout, webhook, database update and confirmation email — before switching to live keys.

Why this needs a full end-to-end test

A payment "succeeding" on screen isn't enough — you need to confirm the money, the order record, and any downstream effect (access granted, email sent) all actually happen together.

Steps to test

Use Stripe test mode first, with Stripe's published test card numbers, to run through checkout without real money.
Confirm the webhook fires and updates your database — e.g. an order marked paid, or a subscription flag set — not just that Stripe shows "succeeded".
Check the confirmation email (if you send one) actually arrives.
Test a failed/declined card using Stripe's test decline numbers, and confirm your app shows a clear error rather than silently failing.
Test a refund in test mode if refunds are part of your flow.
Switch to live keys only once test mode is fully confirmed, and store the live secret key server-side (never in front-end code).
Run one real, small live transaction yourself post-launch to confirm production actually works end to end.

A prompt to check the webhook logic

Walk me through what happens when the Stripe webhook receives a successful payment event — confirm it verifies the Stripe signature and updates the correct database row.

What usually goes wrong

Webhook signature verification skipped, so anyone could fake a "payment succeeded" event by calling your endpoint directly.
Forgetting to switch the webhook endpoint URL and secret from test mode to live mode.
Granting access purely from the client-side redirect after checkout instead of waiting for the server-confirmed webhook — a closed browser tab can leave a paid user without access.
Not testing what happens on a declined card or an abandoned checkout.

For non-trivial payment logic, get it reviewed — PromptSites.com can check a Stripe integration before you go live.

Sources

Stripe testing

Was this answer helpful?