Production checklist
MongoDB production checklist: 6 checks before launch
6 checks for running MongoDB in production: 2 must-dos, 3 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (2)
Enable access control and never expose an unauthenticated instance
Open MongoDB instances are found and ransomed by automated scanners within hours.
Verify from the command line
Connect without credentials and list databases. A pass is an error saying the command requires authentication (on Atlas, the connection itself is refused).
mongosh "mongodb://<host>:27017" --eval "db.adminCommand({ listDatabases: 1 })"Back up on a schedule and test a restore
Replication copies mistakes too; only a backup gets back a dropped collection.
How to verify
In Atlas, the cluster’s Backup tab should show Cloud Backup on with a snapshot schedule; restore one snapshot to a test cluster. Self-hosted, restore a recent mongodump into a scratch instance.
Should do (3)
Restrict network access to your app’s IPs (no 0.0.0.0/0)
Keeps the database off the public internet.
How to verify
In Atlas, open Network Access → IP Access List: there should be no 0.0.0.0/0 entry, only your app’s addresses or a private endpoint. Self-hosted, net.bindIp in mongod.conf should list private addresses only.
Require TLS for every connection
Credentials and documents otherwise cross the network in plain text.
Check the config
Self-hosted, mongod.conf should require TLS; Atlas always does. Your connection string should not set tls=false.
net: tls: mode: requireTLSGive the app user a role on its own database only
An injection bug or leaked connection string then can’t read other databases or drop users.
Verify from the command line
Run this connected as the app’s user. authenticatedUserRoles should be readWrite (or narrower) on the app’s database, never root, dbAdminAnyDatabase or atlasAdmin.
mongosh "<app connection string>" --eval "db.runCommand({ connectionStatus: 1 })"
Good to have (1)
Go through the MongoDB security checklist
TLS, least-privilege roles, auditing and encryption at rest in one list.
How to verify
Go through each section of the checklist and note which apply to your deployment; for Atlas, most are on by default, so check the ones that aren’t (auditing, encryption keys you manage).
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.