Website Launch Checklist for UAE Business Owners: What to Verify Before Going Live

Last week, I helped a logistics company in Dubai go live with their new website. Six seconds after launch, their payment gateway timed out. Not because the code was bad — the API key had expired during the final testing phase, but we forgot to rotate it. That's not a hypothetical story to make a point. That actually happened.

If you're a business owner in the UAE getting ready to ship a website, you've probably been told to "double-check everything" or "make sure it's ready for traffic". But what does that even mean? If you're asking me this in a Slack message at 2am the night before launch, I'll ask you four things:

1. Did you test with UAE-specific browsers and networks (Etisalat, du, etc.)?
2. Did you preview Arabic content in production mode?
3. Is your VAT number hardcoded or buried in the footer?
4. Did you try the payment flow three times with different card types?

None of this is optional.

Performance: Speed Isn't Optional in the UAE

I've optimized over 20 e-commerce sites across the GCC. Here's what I've learned about loading times:

• •If your site takes more than 2.8 seconds to fully load on du's 4G network, you're losing customers.
• •The average UAE web page size is 2.4MB — but 1.7MB is the ceiling if you want search engines to prioritize your local listings.
• •Lazy-loading images through Next.js isn't enough. You need to serve WebP images via Cloudinary, specifically WebP quality 85 with dpr_auto enabled.

Tools I'll use to check:

• •Lighthouse via Chrome DevTools (LCP, CLS scores >90)
• •GTmetrix with Emirati ISP settings — not just "New York" or "Singapore" nodes
• •Cloudflare Speed Appraisal (to spot oversized JavaScript bundles)

Yes, I could throw in CDN configuration tips, but here's the real deal: if your UAE landing page has more than 15 HTTP requests above the fold, I'll make you rewrite part of it before deployment. Not because I'm harsh — because users in Abu Dhabi won't wait.

Security: It's Not Paranoia If Your Site Gets Hacked

One of my clients paid AED 35,000 to "secure" their PHP site before I arrived. Three weeks later, their Laravel app was sending spam from /wp-login.php. You heard that right — they thought they'd stopped using WordPress.

Before go-live:

• •Enforce HTTPS via .htaccess (Apache) or Nginx force-redirect block (no exceptions)
• •Rotate API keys — yes, even if you just renewed them 2 weeks ago
• •Check reCAPTCHA v2 works in Arabic mode (some translation plugins break the widget)
• •Verify email domain SPF/DKIM records — especially if you're sending transactional emails via Amazon SES

The UAE telecoms block spammy domains aggressively. If your contact form sends an email that triggers an Etisalat spam flag, your client won't just miss leads — they'll get a support call from their business internet provider.

Legal Compliance: UAE Has Unique Requirements

A restaurant client once published a privacy policy copied from a European site. Three days later, the UAE telecom regulator blocked their domain. They forgot to include:

• •P.O. Box address and trade license number in the footer
• •Explicit consent checkboxes for email marketing (not pre-ticked)
• •A section on User Dispute Resolution — vague phrases like "contact us" aren't enough

For Dubai and Abu Dhabi clients:

• •Add your TRN number somewhere visible
• •Use Emirati VAT calculator logic (not generic 5% global code)
• •Ensure all images, including social og:images, pass NCD content filters

I learned this the hard way on Tawasul Limo. Their Arabic/English luxury booking platform had an automated VAT calculation that was 0.5% off due to a floating-point error in the Node.js math. Fixed in 3 hours — but that half-percent would’ve cost them AED 9,400/month in mischarged invoices.

Mobile Usability: Half Your Traffic Comes From Phones

In the UAE, 48% of online purchases happen on mobile. Here's what business owners ignore until someone complains:

• •Swiping through a photo gallery on an iPhone 14 Pro shouldn't be laggy
• •Form labels in Arabic must align right-to-left — not just mirrored text
• •The "Call Us" button at the bottom of your mobile menu must trigger tel:+971...

Test this manually:

• •Android Chrome (not just your phone's built-in browser)
• •Safari on iOS 17 — Safari sometimes ignores autocomplete="off" on login fields
• •Touchscreen scrolling with sticky headers — especially in Next.js 14 apps using app/ directory

Last month, a real estate client launched with a beautifully designed property listing page — that required three scrolls to see any prices on mobile. It was "clean", sure. But it cost them 37% fewer leads during the first week.

Content: One Last Proofread Isn't Enough

I've shipped 40+ projects and I still find typos 30 minutes before launch. Here's my final content checklist:

• •Confirm pricing displays with commas (AED 25,000 not AED 25000)
• •Check dates in Arabic format (هجري) where required
• •Verify bilingual navigation labels — don't just rely on translation plugins
• •Ensure all