Build an identifiable artifact
Start from a known source revision and install dependencies consistently. Run checks relevant to the change, then build the files or package to publish. Keep the artifact separate from mutable data. Inspect it for secrets, local configuration and unnecessary development files.
Check before switching traffic
Confirm required settings, permissions and the listening address. Validate the web server configuration before applying it. For a static site, open nested pages directly and check images. Where possible, stage a release in a separate directory and switch a reference after validation.
Verify and record the result
Open the service through its real hostname and check certificate validation. Exercise a representative user path and confirm dependent services still work. Record the checks that actually ran. Data structure changes may need more than an older artifact for rollback; plan compatibility beforehand.