The Peak Season Readiness Checklist: Three Weeks to Black Friday

Black Friday (November 28) is a little over three weeks away. For many stores the Black Friday–Cyber Monday stretch does the work of a normal month or more, so an hour of downtime that is an annoyance in March costs real money in late November. Fixes made during the rush are the worst kind: hurried, under pressure, in production. The cheap fixes happen now. Here's the checklist, ordered roughly by how long each item takes to fix if you find a problem.

Freeze the code, schedule the thaw

Most self-inflicted outages ship in a deploy. The most useful decision you can make this week is picking a code freeze date: the day after which nothing non-critical ships until the peak is over:

• Set the freeze for at least a week before Black Friday, not the day before. You want a full week of normal traffic on the final build to shake out slow leaks and sleeper bugs.
• Define the exception process now. Someone will want to ship "one tiny thing" on November 26. Decide today who can approve emergency changes and what qualifies, so the argument happens once, calmly.
• Freeze infrastructure too. No routine OS upgrades, no "quick" database version bumps, no DNS restructuring during the window. Boring is the goal.

Sweep everything with an expiry date

Nothing is more preventable, or more embarrassing, than an outage caused by an expiry that was on the calendar all along. This week, check dates on:

• TLS certificates for every domain and subdomain in the money path: apex, www, checkout, api, cdn, the payment callback host. Anything expiring before mid-January gets renewed now, not "when it gets closer."
• Domain registrations. A domain lapsing during peak can mean a multi-day outage. Verify renewal dates and that auto-renew has a working card behind it.
• The card on file at your registrar and CA. Auto-renew fails silently if the card expired in October. Check the actual card, not just the checkbox.

Twenty minutes of checking removes the most avoidable failure mode of the season.

Load-test the money path

Your homepage is probably fine; it's cached. The pages that fall over under load are the stateful ones: search, cart, checkout, payment. So test the path that makes money, not the path that's easy:

# quick reality check on the money path (don't do this to third parties)
k6 run --vus 200 --duration 5m checkout-journey.js

• Simulate the journey, not the URL. Two hundred users browsing → carting → checking out stresses your database, sessions and payment integration the way real peak traffic will. Two hundred requests to / mostly tests your CDN.
• Test at your projected peak, then add margin. Take last year's peak hour and scale by this year's growth; then test comfortably above it. Traffic spikes when the email campaign lands are sharper than averages suggest.
• Watch what degrades first. The point of the test isn't pass/fail. It's learning which resource saturates first (database connections? PHP workers? the payment provider's rate limit?) so you know what to scale and what to watch on the day.

Baseline your response times

Sites rarely go from healthy to down in one step under load; they get slow first. Slow is your early warning, but only if you know what normal looks like:

• Record this week's response times for your key pages: homepage, category, product, cart, checkout. That's your baseline.
• Alert on degradation, not just downtime. A checkout that took 400 ms in early November and takes 3 seconds on Black Friday morning is an incident in progress. The alert you want fires there, well before the timeouts start.

Audit the third parties you're betting on

On Black Friday you're only as available as your payment provider, email service, CDN, search-as-a-service, and that reviews widget in the footer:

• List every third-party dependency in the purchase path, and mark which ones can take checkout down versus merely degrade it.
• Subscribe to their status pages by email or webhook, routed somewhere someone looks. When your payment provider has a wobble, you want to know it's them (and say so) rather than burn an hour suspecting your own code.
• Know your degraded modes. If the reviews widget dies, does the product page still render? If the email provider throttles, do order confirmations queue or vanish? Ten minutes of asking beats finding out live. Last month's long AWS us-east-1 outage was a reminder of how many services quietly depend on one provider and one region.

Tighten the monitoring itself

On peak weekend, detection delay comes straight out of revenue:

• Shorten check intervals on the money path for the peak window. A check every minute instead of every three cuts worst-case detection by two minutes, which matters at peak revenue per minute.
• Add content assertions on the funnel: Add to cart present on product pages, the payment form present on checkout, no error in API responses. Peak season's nastiest failures return 200; we wrote up that whole failure class in The page loads, but it's broken.
• Prune noisy alerts now. Any monitor that cries wolf weekly will teach everyone to skim alerts on the one weekend skimming is most costly. Fix it or mute it deliberately.

Confirm humans and comms

• Publish the on-call rota for the peak window: names, dates, and a reachable escalation path if the primary doesn't ack within minutes. "Whoever sees it first" is not a rota.
• Pre-draft your incident comms. A status page ready to go, plus templates for "we're investigating," "we've identified the issue," and "resolved." At 11 PM on Black Friday you want to fill in blanks, not compose prose.
• Write down the runbook basics: how to roll back, how to scale up, who to call at the payment provider. The person on call Saturday may not be the person who knows.

Three weeks is enough

Everything above fits in three weeks, and almost none of it fits in the fourth, when the traffic has already arrived. CompleteStatus covers the monitoring half of this list in one place: uptime checks with tight intervals, response-time alerting against your baseline, keyword and API assertions on the funnel, SSL and domain expiry monitoring, and a status page for the comms, with alerts routed to email, Slack, Discord, Telegram or webhooks so the person on call actually hears about it.

Create a free account and spend an hour this week wiring up the money path.