First Steps

• Enable Two Factor Authentication
• Make sure ACL is properly setup
• Disable Mass Mail
• Remove All unused Users, Groups
• Disable User Registration
  • Setup password Complexity if you allow User Registration
• Activate https for the whole site

• Setup ReCaptcha
• Disable Error Reporting
• Setup eMail (SMTP)
• Select Correct Time Zone
• Set Feed eMail Address to “No Email”
• Set the PHP required by your Joomla installation MultiPHP Manager

• Enable SEF → Joomla Enable SEF
• Make sure all of your alias for menus, categories, articles are small caps and use - for space, ex. product-list
• Install ReDJ for making custom urls or redirects from your old site
• Setup a custom 404 page

• Enable Caching & Session → Joomla Caching

• Optimize Media WebImages (TinyPNG is prefered for inexperienced users)

• Delete Unused Extensions
• Update All Extensions

• Uninstall unused Templates

• Enable Cookie Banner
• Create a Terms of Service page
• Create a Privacy page

• Setup Google Analytics
• Check PageSpeed Insights

• Remove All unused Articles, Categories, Menus and Modules.
• Remove All unused Assets (Images etc)
• Empty Trashes
• Check Robots.txt for required changes

You should be ready to go public.