What to verify before a site goes live.
INPUT AND OUTPUT
All database queries parameterised Output escaped for the context it is printed into File uploads validated and execution blocked CSRF tokens on every state-changing form
CONFIGURATION
Debug mode off Error display off, error logging on Credentials in environment configuration, not in code Configuration files outside the web root, or blocked by .htaccess The .env file confirmed unreachable over HTTP
ACCESS
Strong unique passwords Two-factor authentication on administrative accounts The lowest role that works for each user Default accounts removed
INFRASTRUCTURE
HTTPS enforced site-wide File permissions 755 and 644, nothing at 777 The .git directory removed from production Dependencies audited and updated
MONITORING
Errors logged somewhere you will read Backups running and tested
THE ONE MOST OFTEN MISSED
A .git directory left in the web root, which exposes your entire source history including any credentials ever committed. Check for it.
