Django Security Checklist Before You Go Live

Django is secure by default, but a few settings must be changed before production. Run python manage.py check --deploy and go through this list.

Settings

1. DEBUG = False — never expose stack traces.
2. Keep SECRET_KEY in an environment variable, never in Git.
3. Set ALLOWED_HOSTS explicitly.
4. SECURE_SSL_REDIRECT = True and SECURE_HSTS_SECONDS = 31536000.
5. SESSION_COOKIE_SECURE = True and CSRF_COOKIE_SECURE = True.

Habits

6. Never build SQL with string formatting. Use the ORM or query parameters.
7. Escape output. Avoid |safe and mark_safe on user input.
8. Validate uploads — check size and type, and never serve them from the app domain without care.
9. Rate-limit login and forms (e.g. django-axes or DRF throttling).
10. Keep dependencies updated — pip list --outdated and GitHub Dependabot.

Admin

Move the admin from /admin/ to a non-obvious URL, enforce strong passwords and consider 2FA with django-otp.

Security is not a one-time task, but these ten points close the doors most attackers try first.