What to check after cutover
Run all of these from outside, on the public domain. Never trust the upstream directly.
Reachability
Every path in the inventory returns 200, including nested articles, all three asset types and the JSON endpoint. A missing path returns a genuine 404 rather than a soft 200 — a 200 on a nonexistent URL will get indexed.
Leakage
Fetch each page and grep the HTML for the upstream hostname. It should appear nowhere.
Check redirects separately: request the trailing-slash form of each path and confirm the
Location header stays on the public domain, or is relative.
Indexing
Confirm no site-wide x-robots-tag: noindex is being returned, that canonicals
point at the public domain, and that the sitemap lists public-domain URLs only.
Behaviour under load
Check what happens when the upstream is unavailable, and confirm cache headers are what you expect at each hop — the edge in front and the origin behind can disagree, and the visitor only ever sees the outcome.