Production checklist
Netlify production checklist: 5 checks before launch
5 checks for running Netlify in production: 3 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (3)
Scope environment variables by deploy context
Keep production secrets out of deploy previews and branch deploys.
Verify from the command line
Compare the production and deploy-preview contexts; secrets should only be set for production.
netlify env:list --context production netlify env:list --context deploy-preview
Keep secret scanning on and fix what it finds
Netlify fails the build when a secret value turns up in your code or build output, before it’s published.
How to verify
Secret values are marked as secret in Project configuration → Environment variables, and recent deploy logs show the secrets scan passing.
Send security headers with a
_headersfile ornetlify.tomlNetlify doesn’t add a Content Security Policy for you.
Verify with a request
Request your site and check the headers are there.
curl -sI https://<your-site> | grep -iE "content-security-policy|strict-transport-security|x-frame-options|x-content-type-options"
Good to have (2)
Password-protect or restrict deploy previews
Deploy previews are public URLs by default.
How to verify
Project configuration → General → Visitor access: password protection is set for non-production deploys. Open a deploy preview in a private window; it should ask for the password.
Add rate limiting rules to functions and hot routes
Stops one client from running up function invocations or hammering a login route.
Verify from the command line
Send a burst of requests to a limited route; after the limit you should get 429 responses.
for i in $(seq 1 30); do curl -s -o /dev/null -w "%{http_code} " https://<your-site>/<route>; done
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.