v0 launch checklist: what's still missing after deploy

1. Per-page metadata

v0 gives you placeholder titles like Vercel App or My App. Every public page needs a real <title> and <meta name="description">. The title is the first thing a search result shows; the description is the snippet under it. Both influence whether someone clicks.

Also check the canonical tag: every page should point a self-referencing canonical at itself, and the URL in the canonical must match the URL in your sitemap exactly — same protocol, same host, same trailing-slash choice. A mismatch splits your ranking signals.

2. Open Graph and Twitter cards

A shared link without OG tags unfurls as a blank card with the page title only. You need og:title, og:description, og:image and og:url on every public page, plus the equivalent twitter:card tags. The image must be absolute, at least 1200×630, and exist at that URL — a 404 on the OG image is as bad as none at all.

3. Security headers

A generated Next.js deploy ships with almost no security headers. Actuant checks each of these on your actual deployment:

• Content-Security-Policy. Tells the browser which scripts, styles and connections to trust. A missing CSP leaves you open to XSS; a weak one (with unsafe-inline and unsafe-eval) is barely better than none.
• Strict-Transport-Security (HSTS). Forces HTTPS for every future visit. Without it, a first-time visitor over HTTP can be intercepted before the redirect fires.
• X-Frame-Options or frame-ancestors. Prevents your app from being embedded in an invisible iframe on a malicious site — the classic clickjacking vector.
• Referrer-Policy. Controls how much of your URL is sent when a user clicks an outbound link. strict-origin-when-cross-origin is the safe default.
• Permissions-Policy. Restricts which browser APIs (camera, mic, geolocation) your app can access. A generated app typically leaves them all open.

4. Structured data (JSON-LD)

Schema.org markup tells Google exactly what your app is — a SoftwareApplication, an Organization, its pricing and categories — instead of making it guess from your prose. v0 doesn't generate this, so you need to add it. The two most impactful types for a shipped app are Organization (disambiguates your brand in the Knowledge Graph) and SoftwareApplication (powers the rich result with rating and pricing).

5. sitemap.xml and robots.txt

Next.js can generate a sitemap, but v0's bootstrapped project rarely has one wired. A sitemap tells search engines which URLs exist and how often they change. Reference it from robots.txt with Sitemap: https://yourapp.com/sitemap.xml. Without it, Google has to discover your pages through links alone.

6. AI visibility

Being indexed by Google and being cited by ChatGPT are two different things. AI assistants retrieve from high-authority sources and directories. Getting cited requires being crawlable (which you are, thanks to SSR), being mentioned on pages models already trust, and having an llms.txt that tells a model what your product is and where to find your docs. See llms.txt: how to get cited for the full picture.

7. Payment and conversion surface

If your v0 app takes payments, the checkout and billing pages need their own audit: PCI-relevant headers, HTTPS on every page in the flow, and no leaked test keys in the client bundle. Actuant checks for Stripe test keys, missing HTTPS on form pages, and whether the primary CTA is actually reachable and visible.

The checklist as a score

Every item above maps to a deterministic check Actuant runs on your deployed v0 app. It loads the URL in a real browser, reads the headers, the HTML, the structured data and the third-party scripts, and scores it 0–100. The report shows each check as pass, partial or fail with the exact line or header to fix.