Production checklist
Next.js production checklist: 7 checks before launch
7 checks for running Next.js in production: 3 must-dos, 3 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (3)
Check auth in every Server Action and Route Handler, not only in middleware
Middleware can be skipped by some routes and matchers; each data access needs its own check.
Verify from the command line
List every Server Action and Route Handler, then check each one reads the session and checks the user may touch that specific record before reading or writing data.
grep -rlE "['\"]use server['\"]" app src --include=*.ts --include=*.tsx find app src -name "route.ts" -o -name "route.js"
Never put secrets in NEXT_PUBLIC_ variables
NEXT_PUBLIC_ values are inlined into the browser bundle for anyone to read.
Verify from the command line
List every public variable name. None should hold a secret: no SECRET, SERVICE_ROLE, PRIVATE or server-side API keys.
grep -rhoE "NEXT_PUBLIC_[A-Z0-9_]+" --exclude-dir=node_modules --exclude-dir=.next . | sort -u
Stay on a supported Next.js line with the latest patch
Security fixes only land in supported release lines, and Next.js advisories have included middleware bypasses and remote code execution.
Verify from the command line
Check the installed version against the latest patch in your release line (see the Next.js health page) and upgrade if it’s behind.
npm ls next
Should do (3)
Add a Content Security Policy
Limits the damage of any XSS bug.
Verify with a request
The response should carry a Content-Security-Policy header (a nonce-based one if you use inline scripts).
curl -sI https://<your-app> | grep -i content-security-policy
Send HSTS, X-Content-Type-Options and frame protection headers
Next.js doesn’t set them by default; add them in
next.configheaders()or middleware.Verify with a request
All three headers should be present on pages and API routes.
curl -sI https://<your-app> | grep -iE "strict-transport-security|x-content-type-options|x-frame-options"
Allow only your own image hosts in
images.remotePatternsA wildcard turns your image optimizer into a public proxy that anyone can run up, and the optimizer has had its own advisories.
Check the config
images.remotePatterns in next.config lists the exact hosts you load images from; a pass has no hostname: '**' wildcard.
images: { remotePatterns: [{ protocol: 'https', hostname: 'images.<your-domain>' }], }
Good to have (1)
Keep data access in server-only modules
Stops server code and secrets leaking into client components by accident.
Check the code
Modules that touch the database or secrets start with import 'server-only'; importing one from a client component then fails the build.
import 'server-only';
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.