Production checklist
Django production checklist: 6 checks before launch
6 checks for running Django in production: 1 must-do, 3 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (1)
Run the deployment checklist: DEBUG off, SECRET_KEY from the environment
DEBUG=True in production leaks settings and stack traces to visitors.
Verify from the command line
Run Django’s deployment check with your production settings; a pass reports no issues.
DJANGO_SETTINGS_MODULE=<project>.settings.production python manage.py check --deploy
Should do (3)
Set ALLOWED_HOSTS to your own domains
Stops Host-header attacks such as poisoned password-reset links.
Verify with a request
A request with a host you don’t serve should get 400 Bad Request.
curl -sI -H "Host: evil.example" https://<your-app>/
Force HTTPS: SSL redirect, HSTS and secure cookies
Session and CSRF cookies otherwise travel over plain HTTP on the first request.
Check the config
These settings are on in production (check --deploy warns about each one that isn’t). Raise HSTS to a year once HTTPS works everywhere.
SECURE_SSL_REDIRECT = True SECURE_HSTS_SECONDS = 31536000 SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True
Keep CSRF protection on and use
csrf_exemptonly for signed webhooksEvery exempted view can be triggered from another site with your users’ cookies.
Verify from the command line
Every csrf_exempt view should be a webhook that checks its own signature.
grep -rn "csrf_exempt" --include=*.py .
Good to have (2)
Turn on password validators
Rejects common, numeric and too-short passwords at sign-up.
Check the config
AUTH_PASSWORD_VALIDATORS lists the built-in validators (similarity, minimum length, common and numeric passwords).
AUTH_PASSWORD_VALIDATORS = [ {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'}, {'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator'}, {'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'}, {'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator'}, ]Serve user uploads from a separate domain or bucket
Uploaded HTML or SVG served from your own domain can run scripts as your site.
Check the config
MEDIA_URL points at a different domain or a storage bucket, and the web server never executes files from MEDIA_ROOT.
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.