Hardening a Django deployment
Close the common gaps in settings, headers, the admin, the server, and the software supply chain.
This path hardens a running Django deployment from the application outward: security basics, the deploy checks, secrets, headers and CSP, the admin with two-factor authentication, login lockouts and bans with fail2ban or CrowdSec, TLS, the server, updates, dependencies, and a way for researchers to report issues.
Each step is independent enough to apply on its own, but the order puts the most common real-world gaps first.
The steps
- Django Deployment Security Basics You Should Not Skip
A lot of Django apps reach production with local-development assumptions still in place: DEBUG=True, weak host validation, secrets in .env files with broad permissions, Gunicorn...
- Django check --deploy Explained: Every Warning and Fix
Understand every warning from python manage.py check --deploy: HSTS, SSL redirect, cookies, SECRET_KEY, DEBUG, ALLOWED_HOSTS, and when silencing is justified.
- Manage Django Secrets in Production
Store, load, and rotate Django secrets: inventories, file-based secrets, systemd credentials, cloud secret managers, and SECRET_KEY_FALLBACKS.
- Django Security Headers Checklist
Check every HTTP security header a Django site should send: HSTS, CSP, frame options, nosniff, referrer and permissions policies, COOP, and cookie flags.
- Configure a Content Security Policy for Django
Add a Content Security Policy to Django: Django 6 built-in CSP settings or django-csp, nonces for inline scripts, report-only rollout, collecting violation reports, and handling third-party scripts.
- Django Admin Security Checklist
Secure the Django admin in production: access restrictions, strong authentication, permissions, session policy, audit logging, and safe data handling.
- Add Two-Factor Authentication to the Django Admin
Require two-factor authentication for the Django admin in production: django-otp with OTPAdminSite and TOTP devices, recovery codes, enrolling existing staff, passkeys with django-allauth MFA, and avoiding lockouts during rollout.
- Lock Out Brute-Force Logins With django-axes
Protect Django logins from password guessing with django-axes: install the backend and middleware, choose lockout parameters by user and IP, get real client IPs behind proxies, store attempts in cache or database, and unlock users safely.
- Protect Django Logins with fail2ban
Block brute-force attacks on Django login and admin pages with fail2ban: log failed logins with the real client IP, write a filter and jail, ban at the firewall, and combine with app-level rate limiting.
- Protect a Django Server With CrowdSec
Set up CrowdSec to protect a Django server: install the agent and Nginx or firewall bouncer, parse Nginx and Django login logs, detect brute force on /admin and login views, share blocklists, and avoid banning legitimate users behind proxies.
- Harden Nginx TLS for Django (SSL Labs A+)
Configure Nginx TLS for a Django site to earn an SSL Labs A+: TLS 1.2 and 1.3 only, modern ciphers, HSTS with Django settings, OCSP stapling, session settings, certificate chain, and verifying with SSL Labs and testssl.sh.
- Linux Server Hardening Checklist for Django
Harden a Linux server running Django: SSH keys, firewall rules, automatic security updates, least-privilege users, systemd sandboxing, fail2ban, and audit checks.
- Enable Automatic Security Updates on a Django Server
Keep a Django server patched automatically: unattended-upgrades on Ubuntu and Debian or dnf-automatic on RHEL, security-only origins, service restarts, reboot windows, exclusions for PostgreSQL, and monitoring.
- Django Dependency Security Checklist
Secure the software supply chain of a Django app: supported Django versions, pinned and hashed dependencies, vulnerability scanning, private index safety, container image updates, CI action pinning, and SBOMs.
- Add security.txt and a Vulnerability Disclosure Process to a Django Site
Publish /.well-known/security.txt from Django with contact, expiry, policy, and encryption fields, set up a vulnerability disclosure policy and intake mailbox, triage reports, and avoid common mistakes like expired files and unmonitored addresses.