A successful deployment is not the same as a production-ready system. Use this checklist before a public launch and revisit it after major architectural changes.

Security

• Enforce HTTPS and secure cookie settings
• Validate input on the server and escape output in the correct context
• Apply authorization to every protected action, not only to pages
• Store secrets outside source control and rotate exposed credentials
• Rate-limit authentication and expensive endpoints
• Restrict file type, size, storage location, and download permissions

Reliability and data

• Run database migrations safely and test rollback or forward-fix procedures
• Make background jobs retryable and idempotent
• Set timeouts for database, cache, and external HTTP calls
• Automate backups and perform a real restore test

Performance and accessibility

• Measure representative pages on mobile hardware and slower networks
• Add indexes for real query patterns and inspect slow queries
• Navigate primary workflows with a keyboard only
• Verify text and interactive-control contrast in light and dark themes
• Respect reduced-motion preferences

Observability and release safety

• Capture structured errors without logging passwords, tokens, or private data
• Monitor availability, latency, job failures, and resource saturation
• Deploy a known commit from an automated pipeline
• Verify the critical workflow after deployment and keep a tested rollback path

The checklist is complete only when someone is responsible for each item.