Production Checklist

A Django app that works locally is not automatically safe to run in production. Most deployment failures come from a small set of issues: wrong settings, missing secrets, unsafe...

A lot of Django production incidents come from settings.py, not application code.

Understand every warning from python manage.py check --deploy: HSTS, SSL redirect, cookies, SECRET_KEY, DEBUG, ALLOWED_HOSTS, and when silencing is justified.

Secure the Django admin in production: access restrictions, strong authentication, permissions, session policy, audit logging, and safe data handling.

Verify a Django release after every deploy: smoke tests, release version checks, migrations, static files, background jobs, and latency monitoring.

Check every HTTP security header a Django site should send: HSTS, CSP, frame options, nosniff, referrer and permissions policies, COOP, and cookie flags.

Harden a Linux server running Django: SSH keys, firewall rules, automatic security updates, least-privilege users, systemd sandboxing, fail2ban, and audit checks.

Review PostgreSQL for a production Django app: roles and TLS, connections and pooling, memory settings, autovacuum, slow query visibility, backups, and upgrades.

Review a Dockerized Django deployment before production: image build, non-root user, secrets, health checks, volumes, logging, resource limits, and release steps.

A step-by-step runbook for launching a Django site: pre-launch freeze, DNS and TLS cutover, data migration, smoke tests, monitoring during launch, and rollback.

Check that Django backups actually protect you: what to back up, schedules, off-site copies, encryption, retention, restore drills, and monitoring.

Check monitoring coverage for a Django deployment: logs, errors, metrics, traces, uptime, background jobs, database signals, alert routing, and on-call practices.

Review Celery before production: broker durability, queues and routing, retries and idempotency, time limits, single Beat, monitoring, deploys, and security.

Review a Django REST API before production: authentication, permissions, throttling, pagination, validation, versioning, errors, CORS, docs, and observability.

Upgrade Django in production safely: plan the target version, read release notes, fix deprecations, upgrade dependencies, test, deploy, and roll back if needed.

Hand over a production Django project cleanly: repository and access, infrastructure inventory, secrets rotation, deploy and rollback runbooks, backups and restore tests, monitoring, domains, and third-party accounts.

A production checklist for Django static files: STATIC_ROOT and collectstatic in the build, manifest storage for cache busting, serving with WhiteNoise, Nginx, or a CDN, cache headers, compression, frontend bundles, and admin assets.

Shut down an old Django server safely after a migration: confirm no traffic or jobs remain, take final backups, export logs, revoke credentials and keys, remove DNS records and firewall rules, wipe disks, cancel billing, and update documentation.

A pre-launch performance checklist for Django: query counts and indexes, caching, static and media delivery, Gunicorn and database sizing, background work, timeouts, and a load test against targets.

A technical privacy checklist for Django in production: personal data inventory, logs and error tracking, cookies, retention and deletion including backups, exports, encryption, access control, and processors.

A runbook for Django production incidents: declare and assign roles, triage with a fixed checklist across proxy, app, workers, database, and cache, mitigate first, communicate, and run a blameless review.

Secure the software supply chain of a Django app: supported Django versions, pinned and hashed dependencies, vulnerability scanning, private index safety, container image updates, CI action pinning, and SBOMs.

Secure user uploads in Django production: size limits at every layer, content-based type checks, image re-encoding, safe file names, private storage, serving user content safely, scanning, and quotas.

A production checklist for Redis in Django stacks: separate roles for cache, sessions, and Celery; memory limits and eviction; persistence; network security and TLS; client timeouts; monitoring; and upgrades.

Make Django's transactional email reach inboxes: a reputable provider, SPF, DKIM, and DMARC alignment, sender addresses, bounce and complaint handling, content hygiene, background sending, and monitoring.

A production checklist for Django on AWS: account security, VPC and security groups, IAM roles instead of keys, RDS and ElastiCache settings, S3 and CloudFront, secrets, TLS, logging, backups, and cost controls.

A production checklist for running Django on Gunicorn: bind address and socket, worker class and count, timeouts and graceful shutdown, worker recycling, logging, forwarded headers, process supervision, and the proxy in front.

A production checklist for Nginx in front of Django: server blocks and redirects, TLS, proxy headers, static and media serving, body size and timeouts, buffering, compression, security headers, logging, and safe reloads.

A checklist for a Django CI/CD pipeline: tests on the production database engine, migration checks, linting and security scans, building one artefact, deploying migrations safely, smoke tests, approvals, rollback, and secrets handling.

A launch checklist for a Django SaaS product: production settings and security, tenant isolation, authentication and 2FA, billing webhooks, email deliverability, backups, monitoring, legal pages and data protection, support, and capacity.

A production checklist for Wagtail CMS sites: WAGTAILADMIN_BASE_URL and Sites, image renditions and storage, search backend, cache invalidation and frontend caching, admin security, scheduled publishing, backups of media, and upgrade routine.

Prepare a Django app for a launch, sale, TV mention, or viral post: load test the critical paths, cache anonymous pages at the edge, protect the database, scale workers and queues, add rate limits and graceful degradation, and staff the event.

A launch checklist for Django online stores: payment and webhook reliability, order and inventory integrity, transactional emails, taxes and prices, performance under traffic, backups, monitoring of checkout, legal pages, and a rollback plan for launch day.

A production checklist for Django user uploads: object storage instead of local disk, upload limits and validation, private versus public files, unique names, image processing in workers, CDN delivery, backups and versioning, and cleanup of orphaned files.

Prepare a Django application for a penetration test: fix the findings testers always report first, agree scope and rules of engagement, set up a production-like test environment with seeded accounts, keep monitoring on, and plan remediation and retesting.

A checklist for switching DNS when moving a Django site to a new server, host, or CDN: lower TTLs in advance, prepare TLS certificates and ALLOWED_HOSTS, sync data and freeze writes, switch records, verify from several locations, and keep the old host as a fallback.

A production checklist for Django APIs serving iOS and Android apps: token auth with refresh and revocation, API versioning for old app versions, push notifications through Celery, rate limiting, upload handling, minimum supported versions, and monitoring per app version.

A checklist for putting Django behind a load balancer: health checks that pass host validation, forwarded headers and SECURE_PROXY_SSL_HEADER, correct client IPs, idle and request timeouts, connection draining, sticky sessions avoided, and TLS policy.

A production checklist for email from Django: a transactional provider or Anymail backend, sending from Celery after commit, SPF, DKIM, and DMARC, bounce and complaint webhooks, separate streams for marketing, templates with text parts, staging safety, and monitoring.

A checklist for observability of a production Django system: structured logs with request IDs, RED metrics for web and Celery, distributed tracing, error tracking, database and queue visibility, SLO-based alerts, dashboards per service, and runbooks linked from alerts.

A production checklist for Django on Kubernetes: images, probes, resources, rolling updates, migrations as Jobs, secrets, static and media, Celery and Beat, autoscaling, disruption budgets, and observability.

A production checklist for Django Channels: ASGI server choice, Redis channel layer, WebSocket proxy configuration, authentication and origin checks, consumer performance, scaling, timeouts and heartbeats, deploys, and monitoring.

A code-review checklist for Django migrations before they reach production: backward compatibility with running code, locking and table rewrites, large-table operations, data migrations, reversibility, dependencies, and deployment order.

A technical readiness checklist for SOC 2 on a Django application: access control and MFA, change management through CI/CD, logging and monitoring, encryption, backups and recovery tests, vulnerability management, vendor review, and evidence collection.

A technical checklist for running a Django application that handles protected health information under HIPAA: BAAs with vendors, access control and MFA, audit logging, encryption in transit and at rest, PHI-safe logging and error tracking, backups, and breach readiness.

A PCI DSS checklist for Django apps accepting card payments: minimize scope with hosted payment fields or redirects, never store card data, secure the pages that load payment scripts, protect against script tampering, manage access, logging, vulnerability scanning, and SAQ evidence.

A checklist for running Django under ASGI in production with Uvicorn, Daphne, Granian, or Hypercorn: choose workers, avoid blocking calls in async views, handle sync middleware and the ORM, configure WebSocket proxies and timeouts, lifespan, and graceful shutdown.

Move a Django app’s self-hosted PostgreSQL to RDS, Cloud SQL, Azure, Neon, or another managed service: check versions and extensions, choose dump/restore or logical replication, handle roles and ownership, plan cutover and rollback, and verify Django afterwards.

A production checklist for multi-tenant Django SaaS apps: choose shared tables, schemas, or databases, enforce tenant isolation in queries and caches, scope files and background jobs, handle custom domains, run migrations per tenant, and test for cross-tenant leaks.

A security checklist for Django on Kubernetes: non-root containers with read-only filesystems, Pod Security Standards, minimal RBAC and service account tokens, secrets from a manager, NetworkPolicies, image scanning and signing, patched nodes, and audit logging.