Production checklist
Express production checklist: 7 checks before launch
7 checks for running Express in production: 4 should-dos and 3 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (4)
Follow the Express production security checklist
Security headers (Helmet), rate limiting, cookie settings and trust proxy in one place.
How to verify
Go through each section of the page (TLS, input, Helmet, cookies, brute force, dependencies) and note what your app does for it; the items below cover the main ones.
Set security headers with Helmet
One middleware adds a Content Security Policy, HSTS and frame protection.
Verify with a request
With app.use(helmet()) in place, responses carry these headers.
curl -sI https://<your-api> | grep -iE "content-security-policy|strict-transport-security|x-content-type-options"
Set
secureandhttpOnlyon session cookies and rename the default cookieStops session cookies leaking over plain HTTP or to scripts injected into the page.
Verify with a request
Sign in and look at the Set-Cookie header: it should include Secure and HttpOnly (and a SameSite value), and the session cookie shouldn’t use the default name.
curl -si -X POST https://<your-api>/login -d "<credentials>" | grep -i set-cookie
Rate-limit failed logins by username and IP
Slows down password guessing and credential stuffing.
Verify from the command line
Try a wrong password repeatedly; after the limit you should get 429 responses.
for i in $(seq 1 20); do curl -s -o /dev/null -w "%{http_code} " -X POST https://<your-api>/login -d "user=test&password=wrong"; done
Good to have (3)
Turn off the X-Powered-By header
It tells attackers you run Express, which narrows down the exploits to try.
Verify with a request
A pass prints nothing (Helmet also removes the header).
curl -sI https://<your-api> | grep -i x-powered-by
Run with
NODE_ENV=productionExpress then caches view templates and shows less detail in error responses.
Verify from the command line
Check the environment the server runs in; it should print production.
node -e "console.log(process.env.NODE_ENV)"
Set
trust proxyto match your load balancerWrong, and every client looks like the proxy (one rate limit for everyone) or can fake its IP.
Check the code
trust proxy is set to the number of proxies in front of the app (or their addresses), and req.ip shows the real client address in your logs.
app.set('trust proxy', 1);
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.