Django Production Checklist (Everything You Must Do Before Going Live)

Before you deploy your Django app to production, there are several critical steps you must complete.

If you skip these, you risk:

• Broken static files
• Security vulnerabilities
• Performance issues
• Downtime

This checklist ensures your app is secure, stable, and production-ready.

⚡ Quick Checklist (Overview)

• DEBUG disabled
• ALLOWED_HOSTS configured
• Static files working
• Media files working
• Gunicorn configured
• Nginx configured
• Database configured (PostgreSQL recommended)
• HTTPS enabled
• Environment variables secured
• Permissions set correctly

🧠 1. Django Settings (Critical)

Disable DEBUG

DEBUG = False

👉 Leaving this enabled is a major security risk

Set ALLOWED_HOSTS

ALLOWED_HOSTS = ['your-domain.com', 'your-server-ip']

Use environment variables

Never hardcode:

• Secret keys
• Database credentials

🧱 2. Static Files Setup

• Set STATIC_ROOT
• Run collectstatic
• Configure Nginx

python manage.py collectstatic

👉 Full guide: Django static files not loading

🧩 3. Media Files Setup

• Set MEDIA_ROOT
• Configure Nginx

👉 Full guide: Django media files not serving

⚙️ 4. Application Server (Gunicorn)

• Install Gunicorn
• Configure systemd
• Ensure it runs on boot

sudo systemctl enable gunicorn

👉 Full guide: Deploy Django with Nginx + Gunicorn

🌐 5. Web Server (Nginx)

• Reverse proxy to Gunicorn
• Serve static and media files
• Validate config

sudo nginx -t

🗄️ 6. Database (Production Setup)

Do NOT use SQLite in production.

Use:

• PostgreSQL (recommended)

Check:

• Migrations applied
• Database accessible

python manage.py migrate

🔐 7. HTTPS (Required)

Use Let's Encrypt for free SSL certificates.

sudo certbot --nginx

Also enable:

• Secure cookies
• HSTS headers

🔒 8. Security Settings

In settings.py:

SECURE_BROWSER_XSS_FILTER = True
SECURE_CONTENT_TYPE_NOSNIFF = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True

👉 Prevents common vulnerabilities

📁 9. File Permissions

sudo chown -R www-data:www-data /var/www/myproject
sudo chmod -R 755 /var/www/myproject

👉 Prevents access and runtime errors

🔄 10. Process Management

Ensure services restart automatically:

sudo systemctl enable gunicorn
sudo systemctl enable nginx

🧪 11. Logging & Debugging

Check logs:

journalctl -u gunicorn
sudo tail -f /var/log/nginx/error.log

👉 Essential for troubleshooting

⚡ 12. Performance Basics

Set Gunicorn workers:

workers = (2 × CPU cores) + 1

• Enable gzip in Nginx
• Use caching headers

🧠 13. Environment Separation

Use:

.env files

Different settings for dev/prod

👉 Avoids configuration mistakes

🔁 14. Deployment Workflow

Before every deployment:

git pull
pip install -r requirements.txt
python manage.py migrate
python manage.py collectstatic
sudo systemctl restart gunicorn

🔥 Common Mistakes

🔴 DEBUG left on

👉 Security risk

🔴 Static files not configured

👉 Broken UI

🔴 No HTTPS

👉 Insecure site

🔴 Wrong permissions

👉 Runtime errors

🔴 No process restart

👉 Downtime after reboot

🔗 Related Guides

• Deploy Django with Nginx + Gunicorn
• Set up HTTPS for Django
• Fix Django 502 Bad Gateway
• Django static files not loading
• Django media files not serving

❓ FAQ

Can I use SQLite in production?

Not recommended.

Use PostgreSQL for:

Performance Reliability

Do I need Docker?

Optional—but useful for:

• Consistency
• Easier deployments

How do I know everything works?

Use this checklist + test:

• Homepage
• Admin panel
• Static files
• Uploads

🎯 Final takeaway

A production-ready Django app requires:

• Correct configuration
• Proper security
• Reliable deployment setup

If you deploy often…

Using a repeatable, pre-tested system saves time and prevents errors.