Site Info · Pre-launch Checklist · 9 August 2026 (live stress test)
Star Aesthetic Centre
Launch readiness overview for Dr. Rajeev Bangalee & Nakita — technical status, SEO, tracking, and go-live actions.
Status: 61% complete (28/46 checks passed)
28 pass11 warn3 fail4 info
Critical Checks
Must be solid before removing the preview password and opening the site publicly.
Domain & canonical URL
Primary host is https://staraesthetic.co.za (apex). Canonicals and metadataBase are set in lib/seo.ts; www redirects via Vercel.
SSL / HTTPS
Production traffic is HTTPS via Vercel. No mixed-content config required for the Next.js app.
Responsive design
Tailwind mobile-first layout across homepage, treatments, shop, booking, and admin.
Primary contact info
RESOLVED 9 Aug 2026. Phone +27 (0)31 573 1325 and 22 Ennisdale Drive appear consistently in footer, contact, schema and emails. The public email address was previously split between info@staraesthetic.co.za (schema, footer, legal pages) and info@staraesthetic.site (order and booking mail); all 23 references are now info@staraesthetic.site, and ORDER_ADMIN_EMAILS no longer carries a duplicate address.
Broken links / URL accuracy
Cookie consent privacy link and llms.txt treatment URLs corrected in this audit. Spot-check Instagram/Facebook profile URLs and any CMS-edited contact WhatsApp placeholder before launch.
Form submissions
TESTED 9 Aug 2026 with real submissions and inbox verification. Shop checkout, gift voucher purchase, /book consultation and the skin assessment all completed and delivered every expected email. Contact form and review submission NOT yet tested. Forms use honeypot + Cloudflare Turnstile via public-form-guard; keys confirmed present on Vercel.
Turnstile — confirmed working (invisible mode)
Initially flagged as missing because no widget was visible on /book or /submit-review. That was wrong: Cloudflare is running in invisible/managed mode. Inspecting the review form found a cf-turnstile-response hidden field already carrying a token, and the challenge script loading from challenges.cloudflare.com. Public forms are protected; there is simply nothing for a legitimate visitor to click.
Preview password gate
LIFTED. Verified 9 Aug 2026: https://staraesthetic.co.za returns 200 with no redirect to /preview-login. SITE_PASSWORD is unset on Vercel and the site is publicly reachable.
Search indexing switch
LIVE. Verified 9 Aug 2026: no noindex meta, no X-Robots-Tag, robots.txt allows all crawlers (including GPTBot, ClaudeBot, PerplexityBot) and declares the sitemap. THE SITE IS PUBLIC AND INDEXABLE — every remaining WARN and FAIL on this page is now a live-site issue, not a pre-launch one.
Content & SEO
On-page foundations, crawlability, and structured data for Google and AI search.
Page titles & metadata
Root title template and buildPageMetadata() provide titles, descriptions, canonicals, and keywords across key routes.
Meta descriptions
Homepage, treatments, shop, legal, and doctor pages ship dedicated descriptions.
Image alt text
Hero, treatment cards, products, and doctor imagery use descriptive alt attributes (not empty decorative defaults on public surfaces).
Open Graph / social share
Default OG image and per-page OG/Twitter cards via lib/seo.ts and root layout.
XML sitemap
Dynamic /sitemap.xml covers static pages, 12 treatments, brands, active products, and glossary terms.
robots.txt + AI crawlers
When indexing is allowed: GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended are permitted; admin/api/cart/checkout disallowed.
Structured data
LocalBusiness / MedicalBusiness / HealthAndBeautyBusiness on layout; MedicalProcedure + FAQ on treatments; Product offers; Person on doctor page; BreadcrumbList helpers.
llms.txt
Public /llms.txt present for LLM discovery; treatment URLs aligned with live routes.
Legal pages
Privacy, Terms, Returns, and Shipping live under /legal/* and are in the sitemap.
Favicon / app icon
STALE CHECK, corrected 9 Aug 2026. All five icons are present in app/: icon.jpg, icon.png, apple-icon.jpg, apple-icon.png and favicon.ico. This was marked FAIL from an audit taken before they were added.
HPCSA registration number
Dr Bangalee page states HPCSA registration but does not show a registration number. Add when available for E-E-A-T.
Concerns / content pillar
Future Plans roadmap (concerns hubs) is not live yet — optional post-launch SEO expansion, not a hard launch blocker.
Google Search Console + sitemap submit
Add staraesthetic.co.za property, Change of Address from legacy .site if applicable, submit https://staraesthetic.co.za/sitemap.xml.
Legacy domains (.site / .online)
Correctly handled. staraesthetic.site 301s to the main site. staraesthetic.online returns 200 rather than redirecting, but it is a Vercel alias serving the SAME app and every page declares <link rel=canonical> and og:url pointing at staraesthetic.co.za — verified 9 Aug 2026. Google consolidates to the canonical, so this is not duplicate content. A 301 would still be marginally stronger than a canonical (definitive rather than a hint, and stops the alias being crawled at all), but it is an optimisation, not a problem. Separately: Google still has legacy .html URLs indexed from the pre-Next.js site — worth a Change of Address in Search Console once that account is restored.
Tracking & Analytics
Measurement and marketing pixels — none are required for soft launch, but GSC is.
Google Analytics 4
BLOCKED, not merely missing. The practice Google account (info@staraesthetic.site) was disabled by Google in 2024; an appeal was submitted 8 Aug 2026 and takes ~2 business days. No GA4 property exists. When restored, create the property under a CURRENT account — not the disabled one — then set GA4_PROPERTY_ID. Live reporting additionally needs the GA4 Data API and a service account. Admin → Dashboard → Channels shows this status.
Meta (Facebook) Pixel
No fbq / Meta Pixel code present.
Channels panel (admin)
Admin dashboard now surfaces both Facebook pages, Instagram and GA with live/error/not-connected states. Follower counts need META_PAGE_ACCESS_TOKEN plus page IDs; without them the panel shows a dash rather than inventing a number.
Cookie / privacy consent
CookieConsent banner stores accept/decline. Privacy policy covers POPIA. Banner links to /legal/privacy-policy.
Google Business Profile
Update GBP website URL to https://staraesthetic.co.za and refresh photos/services/categories at launch. NOW URGENT: if the profile sat under the disabled Google account it may be orphaned — for a Durban clinic, GBP drives map-pack visibility and matters more than GA history. Confirm who controls it.
Social profile links
FIXED 8 Aug 2026. The footer icons and the MedicalClinic sameAs schema pointed at accounts belonging to other people — facebook.com/staraesthetic (an unrelated business in China) and instagram.com/staraesthetic (a private personal account, 1 follower). Now facebook.com/staraesthetic.centre and instagram.com/staraestheticcentre (3,768 followers, verified).
Duplicate Facebook page
The clinic has TWO pages: /staraesthetic.centre and /StarAestheticC ("Star Aesthetic Centre | Durban North", the one Google indexes). Reviews and followers are split across both, weakening entity resolution. Merge them — but EXPORT BOTH FIRST: Meta combines followers while permanently deleting the absorbed page's posts, photos and videos. sameAs currently points at /staraesthetic.centre and must match whichever survives.
Instagram bio link
Bio still points at the old staraesthetic.site, sending 3,768 followers to the wrong website. One-minute fix, highest return of any item on this page.
Accessibility & Security
Spam protection, admin access, and baseline a11y posture.
Admin authentication
Middleware protects /admin/* behind admin_session cookie; login at /admin/login.
Spam protection (Turnstile + honeypot)
Public write APIs go through public-form-guard. Preview mode also blocks unauthenticated POSTs to gated APIs when SITE_PASSWORD is set.
Custom security headers
No CSP / HSTS / X-Frame-Options overrides in next.config.ts. Vercel supplies HTTPS; consider adding headers post-launch.
Accessibility (contrast / keyboard / ARIA)
Some ARIA labels and dialog roles exist (e.g. cookie banner). No formal WCAG audit run in this pass — schedule a mobile keyboard pass before launch.
Commerce & Patient Features
Shop, booking, and engagement systems that must smoke-test cleanly.
Shop + checkout (EFT)
VERIFIED 9 Aug 2026: order SAC-2026-003 placed end to end (R1 745, EFT, pending). Sequential numbering advanced 002 → 003. Self-collection correctly hid the address fields and dropped shipping (R880 → R760). Customer confirmation and clinic notification both delivered. NOTE: the checkout diverts to the /buy funnel offer when a cart item has an uncompleted funnel — by design, but it means "Place order" does not always submit on the first click.
Online booking
VERIFIED 9 Aug 2026: booking SAC-BK-2026-001 confirmed (first use of the new sequential format, replacing SAC-20260709-3Q00). Past dates, today, and Sundays correctly disabled; 8 slots offered. Customer confirmation and clinic notification both delivered. See the Turnstile warning under Critical Checks.
Clinic notifications
All three revenue paths now alert the clinic: shop orders, bookings, and — since 9 Aug 2026 — gift vouchers. Voucher orders previously notified nobody, which mattered because staff must match an incoming EFT to a SAC-GV- reference. Card voucher purchases notify from the PayFast ITN once payment is confirmed, not at checkout, so unpaid card attempts are not announced.
Skin assessment data capture
FIXED 9 Aug 2026. The twelve-question assessment stored only four summary fields and discarded the rest, including the post-gate answers (desired outcome, main obstacle, preferred approach) that a consultation actually turns on. Now stores all 17, marks completed vs abandoned, and renders under "View answers" in Admin → Leads. The face photo is deliberately NOT stored — it arrives as a base64 data URL and is health-related personal information under POPIA; a photoProvided flag is kept instead.
Gift vouchers & rewards
Voucher purchase/activation and Starlights loyalty programme are implemented. CRITICAL BUG FIXED 8 Aug 2026: voucher creation had been failing with "Failed to create voucher(s)" since mid-May — the gift_vouchers table was missing five columns the API inserts, because re-running a `create table if not exists` schema file silently changes nothing on an existing table. Migration applied and verified; purchases confirmed working. The route now logs the real Postgres error instead of a generic message.
PayFast card payments
Built for both the shop and gift vouchers, gated off behind NEXT_PUBLIC_PAYFAST_ENABLED until PayFast verifies the business documents. Vouchers use their own ITN endpoint so the order payment path stays untouched. Activation claims its status transition atomically, so ITN retries cannot email a recipient their voucher twice. NOT YET TESTED end-to-end against the PayFast sandbox — do that before flipping the flag.
Test records on production — clean these up
The 9 Aug stress test wrote real rows to the live database. Vouchers SAC-GV-EN4XLW and SAC-GV-6YXL2J; order SAC-2026-003; booking SAC-BK-2026-001 (Monday 10 August, 9:00 AM — cancel this before someone prepares for a patient who does not exist); leads Emily Testerly and Olivia Fulltest.
Patient reviews
NEW 8 Aug 2026. Guided review form at /submit-review with questions tailored per treatment (a weight-loss programme and a lip filler appointment are not the same experience). Per-treatment display on all 12 treatment pages, with a founding-reviewer offer while fewer than three exist. Moderation queue at /admin/reviews — nothing publishes without approval, and RLS is on with no policies so the anon key cannot read the table at all. Questions deliberately ask about care and aftercare rather than clinical results, given HPCSA restrictions on testimonial advertising. Post-appointment request email runs daily at 11:00. NOT YET TESTED end to end — submission needs a real browser because of Turnstile, and the moderation queue has never been exercised with a genuine review.
Treatment imagery
New June 2026 WebP set (34–60 KB) installed across cards, listing and detail pages, plus the new "Assessed by Dr. Bangalee" sidebar card. NOTE: anti-wrinkle-treatment and lip-filler carry card_image overrides in the database from earlier admin uploads; database beats code, so clear those two in /admin/treatments after deploy or they keep the old pictures.
Niki AI assistant
Floating widget + skin assessment flows; requires GEMINI_API_KEY on Vercel.
WhatsApp click-to-chat
wa.me links on contact, booking, products, and Niki. Confirm NEXT_PUBLIC_WHATSAPP_NUMBER on Vercel matches the live clinic number (defaults/content still include a placeholder in one CMS default).
Performance & SEO Scores
Scores from the 26 May 2026 SEO audit, lightly adjusted for work completed since (llms.txt, indexing wiring). Re-measure Core Web Vitals on the live ungated site.
Pre-indexation capability score
SSR, sitemap, canonicals, AI crawlers
6+ schema types live
Metadata solid; content depth still growing
Doctor page strong; HPCSA number + blog still open
llms.txt + crawler allowlist in place
Run PageSpeed on production after gate removal
Site Information
Go-live Sequence
Do these in order when Nakita and Dr Bangalee are ready for public traffic.
- 1.Unset SITE_PASSWORD in Vercel (remove preview gate).
- 2.Confirm ALLOW_SEARCH_INDEXING=true in Vercel.
- 3.Confirm Turnstile + WhatsApp env vars on Vercel (correct NEXT_PUBLIC_ names).
- 4.301 staraesthetic.site → staraesthetic.co.za at DNS/host level.
- 5.Google Search Console: add .co.za, submit sitemap, request indexing for home + top treatments.
- 6.Update Google Business Profile website URL to https://staraesthetic.co.za.
- 7.Align public email (.site vs .co.za) across footer, schema, and transactional mail.
- 8.Add brand favicon (app/icon or public/favicon.ico).
- 9.Smoke test: home, shop → checkout EFT, /book, contact form, admin login, Niki, mobile nav/footer.
Key Pages To Review
Troubleshooting Notes
- FAIL items — favicon, Search Console submit, and analytics pixels. Favicon + GSC are the only hard SEO blockers among them; GA4/Pixel can follow launch if desired.
- WARN items — email consistency, Turnstile env naming, legacy domain 301s, WhatsApp number, GBP update. Resolve before or on launch day.
- Password + indexing — never leave ALLOW_SEARCH_INDEXING=true while SITE_PASSWORD still blocks HTML; crawlers will hit the preview login.
- Local health check:
node scripts/health-check.mjsfromnextjs/(needs Supabase keys).