Site Cutover & Takedown Host Checklist

How it works

Site Cutover & Takedown Host Inventory Checklist is for the moment before you move a site to a new host or domain, switch repositories, or take a site offline. A site is rarely served from one place, so cleaning up one repository leaves other hosts live. This Skill builds a read-only inventory of every place that serves or references the site, then gives you an ordered runbook and a status table. It never changes anything and never makes a network call itself.

Phase 1 — Scope. Goal (cutover, takedown or repo switch), old and new domain and repository, remotes, dates.

Phase 2 — Discover. Greps your repo for DNS and subdomain hints, edge-worker routes, redirects, mirrors and second repos, sitemaps and robots, canonical tags, hard-coded absolute URLs, OAuth/webhook callbacks, analytics and search-console IDs. Every row carries path:line evidence, and the summary counts distinct hosts separately from table rows. Hosts are the real domains from your files; derived or guessed URLs become questions, not verification commands.

Phase 3 — Questions. What a repo cannot show (registrar panel, CDN dashboard, older accounts, provider consoles) becomes "Is there a ...?" questions, never findings.

Phase 4 — Runbook. Ordered steps with a verify command, a rollback and an IRREVERSIBLE flag where it applies.

Phase 5 — Verification. Copy-paste curl -I and dig lines you run yourself. You paste the output; a "gone" verdict needs cache evidence, not just a status code (default cache window 48h unless you state TTLs). It is not a docs audit: the repo-doc-reset-audit Skill checks docs inside one repo after a rewrite, this one checks hosts and URLs across systems.

Sample output

Real, unedited output from running this Skill on a sample problem:

Goal: cutover — 7 distinct hosts / 14 inventory rows — 12 questions open — verified 0 (nothing run yet)

## Scope
- Goal: cutover (old -> new domain).
- Old: "old-example.com" (apex, www., api. labels found). New: "new-example.com" (stated by user). Old repo: acme/old-example (git remote origin, no org/account change stated). New repository: unknown.
- Files searched: all of /tmp/qa2/site (CNAME, index.html, about.html, sitemap.xml, robots.txt, _redirects, wrangler.toml, .github/workflows/deploy.yml, README.md, src/config.js).
- Remotes: `origin https://github.com/acme/old-example.git` (fetch/push). No .gitmodules.
- Dates: none given. DNS TTL: unknown.
- Cache window: 48h default (a default, not a measurement).

## Host inventory
| # | Category | Host / URL | What it does | Source | Needs action |
|---|---|---|---|---|---|
| 1 | A | www.old-example.com | serves (Pages custom domain) | CNAME:1 "www.old-example.com" | Yes: repoint/replace; redirect |
| 2 | B | old-example.com/* | edge route (zone old-example.com) | wrangler.toml:3 `pattern = "old-example.com/*"` | Yes: change route; apex redirect |
| 3 | B | api.old-example.com/* | edge route | wrangler.toml:4 `pattern = "api.old-example.com/*"` | Yes: route to NEW API |
| 4 | B/C | https://www.old-example.com/news/:splat | 301 target in redirect rule | _redirects:1 "/blog/* https://www.old-example.com/news/:splat 301" | Yes: change target to NEW |
| 5 | E | www.old-example.com | references (sitemap URLs) | sitemap.xml:1 "<loc>https://www.old-example.com/</loc>" and about.html loc | Yes: rewrite |
| 6 | E | www.old-example.com | references (Sitemap directive) | robots.txt:2 "Sitemap: https://www.old-example.com/sitemap.xml" | Yes: rewrite |
| 7 | F | www.old-example.com | references (canonical, og:url, og:image) | index.html:3 canonical, :4 og:url, :5 og:image; about.html:3 canonical, :4 og:url | Yes: rewrite |
| 8 | G | www.old-example.com | references (links) | index.html:6 "href=https://www.old-example.com/about.html"; about.html:5 "href=https://www.old-example.com/" | Yes: rewrite |
| 9 | H | https://www.old-example.com/auth/callback | OAuth callback | README.md:3 "OAuth callback: https://www.old-example.com/auth/callback" | Yes: register new callback first, keep old until end |
| 10 | G/H | api.old-example.com | API base URL used by code | src/config.js:1 `API_BASE = "https://api.old-example.com"` | Yes: rewrite after NEW API exists |
| 11 | D | github.com/acme/old-example-mirror | mirror repo publishing a snapshot | README.md:2 "Mirror repo: acme/old-example-mirror publishes a snapshot." | Yes: retire (IRREVERSIBLE) after redirects pass |
| 12 | D | Pages project "old-example-site" | CI deploy target | .github/workflows/deploy.yml:10 "projectName: old-example-site" | Yes: repoint/retire |
| 13 | D | github.com/acme/old-example | origin remote | `git remote -v` | Decide: keep or rename |
| 14 | NEW | new-example.com | target host | stated by user | Verify only; never retire |

Distinct hosts (N=7): old-example.com, www.old-example.com, api.old-example.com, new-example.com, github.com/acme/old-example-mirror, Pages project old-example-site, github.com/acme/old-example.

Also: _redirects:2 "/home / 302" is host-relative (no host); review after cutover.
Files to change for step 4 (not edited here): index.html:3,4,5,6; about.html:3,4,5; sitemap.xml:1; robots.txt:2; _redirects:1; src/config.js:1; README.md:3.
No analytics/tag IDs, search-console tags, cache headers, purge scripts or SPF strings found in the files searched.

## Questions (not findings)
1. Is there an apex record for old-example.com, and where does it point? (registrar/DNS panel)
2. Is there a record for any other subdomain, MX or TXT at old-example.com? (DNS panel)
3. Is there an older account or org that ever hosted the site? (GitHub/Cloudflare accounts)
4. Is there a default platform address for Pages project old-example-site (a *.pages.dev style address)? Not derived here. (Pages dashboard)
5. Is there a default address for acme/old-example-mirror (a *.github.io style address), and is Pages enabled on it? (repo settings)
6. Is there a dashboard-only edge worker or other route on old-example.com not in wrangler.toml? (CDN dashboard)
7. Is there a registered OAuth redirect URI, webhook or payment return URL at the provider console for https://www.old-example.com/auth/callback? (provider console)
8. Is there a www.new-example.com, and is NEW's callback/API host defined (api.new-example.com or other)? Not assumed.
9. Is there a Search Console / analytics property, or tag manager, for old-example.com? (consoles)
10. Is there a social profile, listing, QR code or print material with the old domain?
11. Is there a new repository for NEW, or does acme/old-example stay?
12. Does the mirror snapshot or any old host serve personal data? (priority if yes; removal is your choice, get qualified advice)

## Runbook
1. Freeze and snapshot: copy DNS records/settings, tag repo state (rollback anchor) | `git tag pre-cutover` (you run) | delete tag | no | user
2. Lower DNS TTL on old-example.com records well before switch (old TTL unknown, state it; restore after step 10) | `dig +short old-example.com A` and check TTL | restore old TTL | no | user
3. Stand up new host for new-example.com and verify directly via hosts-file test before DNS | `curl -sI https://new-example.com/` | remove hosts-file line | no | user
4. Change hard-coded URLs, canonical, sitemap, robots: files listed above (a later session or user edits) | `grep -rIn "old-example\.com" .` returns only intentional redirects | revert commit | no | user / later session
5. Register new callbacks first (OAuth for NEW; NEW API base), keep old ones until step 10 | test login on NEW | remove new registration | no | user
6. Switch DNS / routes one at a time: CNAME, wrangler routes (old-example.com/*, api.old-example.com/*), Pages custom domain | Phase 5 curl/dig per host after each change | restore saved records/routes from step 1 | no | user
7. Install permanent path-preserving redirects old -> new (apex, www, api where applicable); fix _redirects:1 target | `curl -sI -L https://www.old-example.com/about.html \| grep -i "^HTTP\|^location"` expects 301 to new-example.com/about.html then 200 | remove redirect rules | no | user
8. Search/analytics: new properties, change-of-address, sitemap resubmission | console shows sitemap fetched | n/a | no | user
9. Retire old hosts (mirror acme/old-example-mirror, Pages project old-example-site, old-account copies) only after step 7 passes. BACKUP first (archive/clone mirror and export Pages project). | mirror variant: `curl -sI` and `dig` expect 404/DNS gone, never a redirect (only after question 4/5 answered) | restore from backup | IRREVERSIBLE (deletion) — confirm with user | user
10. Remove old callbacks and the TTL workaround; rerun status table after the cache window (48h default) | Phase 5 on all hosts | re-add old callback | no | user

## Verification commands
Old apex / www:
```
curl -sI https://old-example.com/
curl -sI https://old-example.com/about.html
curl -sI -L https://old-example.com/ | grep -i "^HTTP\|^location"
curl -sI https://www.old-example.com/ ; curl -sI http://old-example.com/
curl -s https://old-example.com/robots.txt | head
dig +short old-example.com A ; dig +short old-example.com CNAME ; dig +short www.old-example.com CNAME ; dig +short old-example.com MX
```
Expect moved: 301/308 to https://new-example.com/<same path>, 1-2 hops, final 200. Takedown/gone: not applicable here.

api.old-example.com (no endpoint path is written in code; give one real path and I will add it):
```
curl -sI https://api.old-example.com/
dig +short api.old-example.com CNAME
```
Expect: NEW's API (host to be confirmed, question 8).

NEW:
```
curl -sI https://new-example.com/
curl -sI https://new-example.com/about.html
curl -s https://new-example.com/robots.txt | head
dig +short new-example.com A ; dig +short new-example.com CNAME
```
Expect: 200, canonical/sitemap name new-example.com.

Mirror repo github.com/acme/old-example-mirror and Pages project old-example-site: no commands printed until their addresses are confirmed (questions 4, 5).

## Status table
| Host | Expected | Evidence pasted | Status |
|---|---|---|---|
| old-example.com | verified moved: 301 to new-example.com | none | UNSURE (not yet checked) |
| www.old-example.com | verified moved: 301 to new-example.com | none | UNSURE (not yet checked) |
| api.old-example.com | NEW API (host unconfirmed) | none | UNSURE (not yet checked) |
| new-example.com | 200, new canonical | none | UNSURE (not yet checked) |
| github.com/acme/old-example-mirror | verified gone: 404/DNS gone | none | UNSURE (not yet checked) |
| Pages project old-example-site | verified gone: 404/DNS gone | none | UNSURE (not yet checked) |
| github.com/acme/old-example | keep or rename (decision pending) | none | UNSURE (not yet checked) |

## Limits of this check
- grep cannot see registrar/DNS records, CDN dashboard workers, provider consoles, search/analytics properties, third-party caches or search engines.
- No command was run and no network call made; nothing is verified.
- Wait out the cache window before final verdicts: no TTL stated, so the 48h default applies.

Paste the command output and I will fill in the status table.

Use cases

• Moving a site to a new domain without leaving a stale copy or broken callback behind
• Switching a site to a new repository or account and finding the old one still serving
• Taking a site down and proving every host, mirror and cache has actually let go
• Listing every hard-coded old URL, canonical tag and sitemap entry before a rebrand
• Turning "I think we got everything" into a verified gone / verified moved / UNSURE table

FAQ

Does it change my DNS, delete repos or push anything? No. It is read-only. It prints a plan and commands for you to run.

Does it check the live site itself? No. It makes no network calls. It prints curl and dig commands, you run them, and you paste the output back for it to interpret.

Will it find hosts that are not in my repo? No, and it will not pretend to. Registrars, CDN dashboards and third-party consoles are listed as questions to answer, not as findings.

Does it give legal or privacy advice? No. If personal data may be on a host it marks it as priority and says to get qualified advice.

How is it different from a docs audit? A docs audit checks links and stale notes inside one repository. This checks every host and URL involved in a move or takedown.