Identify the selected settings module and supported Django/Python versions. Prepare runtime secrets through the account environment or another protected configuration mechanism.

1. Set DEBUG=False and configure the intended ALLOWED_HOSTS. Keep the production secret key private and separate from development credentials.

2. Configure database, cache and email services for production. Use a distinct database and credentials for staging to prevent test jobs from reaching live customer data.

3. Run python manage.py check --deploy against the production settings. Read each warning in the context of the actual HTTPS and proxy configuration.

4. Set appropriate secure cookie and transport controls after confirming HTTPS works consistently. Plan HSTS carefully because browsers retain it beyond a single request.

5. Restart the app and any workers with the same intended settings. Record where secrets are supplied without writing their values in the handover document.

In your project’s production settings, load the key from protected runtime configuration and keep debug output disabled. This fragment deliberately refuses to start with a missing secret instead of falling back to a predictable example key.

import os

SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
DEBUG = False
ALLOWED_HOSTS = ['example.com', 'www.example.com']

Supply DJANGO_SECRET_KEY through the service’s approved environment mechanism before starting web processes, workers and management commands. Do not place its value in this knowledgebase example or print it during diagnostics. Run the deployment check against the same settings module and review the HTTPS-related findings in the context of your actual proxy.

Expected result: The application starts with its intended private key and shows a controlled public error page. A staging run without the required variable fails clearly, preventing an accidental deployment with a shared fallback secret.

Trigger a harmless missing-page request and verify that no development traceback appears. Test authentication and private service access, then confirm deployment checks remain satisfactory.

If a setting seems ignored, compare the settings module and environment used by the web process with the CLI command. A second environment file or stale worker can cause different behavior.

• Configuring Django hosts and CSRF origins behind HTTPS
• Moving runtime secrets out of a public document root
• Using environment variables consistently across web and CLI
• Choosing WSGI or ASGI for Django hosting

• Django: Checklist
• Django settings

• Django: Checklist