DEBUG, SECRET_KEY, and ALLOWED_HOSTS
Get the dangerous settings right.
DEBUG, SECRET_KEY, and ALLOWED_HOSTS is a free Django Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Django Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Three Dangerous Settings
Three settings in settings.py can sink a production site if you get them wrong. Let us tame DEBUG, SECRET_KEY, and ALLOWED_HOSTS together. 🔒
What DEBUG Does
When DEBUG is True, Django shows detailed error pages with your code, settings, and traceback. That is gold in dev but a gift to attackers in production.
DEBUG = TrueTurn DEBUG Off in Production
In production, set DEBUG to False so users see a generic 500 page instead of your internals. Never ship a live site with DEBUG on.
DEBUG = FalseMeet SECRET_KEY
The SECRET_KEY is the seed Django uses to sign sessions, CSRF tokens, and password resets. Leak it and an attacker can forge any of them.
SECRET_KEY = "django-insecure-..."Keep SECRET_KEY Secret
Never commit your real SECRET_KEY to git. Load it from an environment variable so the value lives outside your code.
import os
SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]Generate a Strong Key
Need a fresh SECRET_KEY? Django ships a helper that returns a long, random, hard-to-guess string for you to store securely.
from django.core.management.utils import get_random_secret_key
get_random_secret_key()Why ALLOWED_HOSTS Exists
ALLOWED_HOSTS lists the domains your site is allowed to serve. It blocks HTTP Host header attacks that try to trick your app with a fake hostname.
Set Your Real Domains
Fill ALLOWED_HOSTS with the exact domains your site answers to. With DEBUG off, any request to an unlisted host gets a 400 error.
ALLOWED_HOSTS = ["example.com", "www.example.com"]Avoid the Wildcard Trap
Setting ALLOWED_HOSTS to the wildcard accepts any host header and defeats the protection. Use it only for quick local tests, never in production.
ALLOWED_HOSTS = ["*"]Drive It All From Env
The clean pattern is one source of truth: read DEBUG, SECRET_KEY, and hosts from environment variables so the same code runs safely everywhere.
DEBUG = os.environ.get("DEBUG", "0") == "1"Let Django Warn You
Django can audit these settings for you. The check --deploy command flags an unsafe DEBUG, weak key, or open hosts before you ship.
python manage.py check --deployQuick Check
Time to test your instinct about production settings.
Recap: The Safe Trio
You locked down the basics: DEBUG off, a secret key kept out of git, and ALLOWED_HOSTS scoped to your domains. Run check --deploy and you are off to a safe start. 🎉
Frequently asked questions
Is the “DEBUG, SECRET_KEY, and ALLOWED_HOSTS” lesson free?
Yes — the full text of “DEBUG, SECRET_KEY, and ALLOWED_HOSTS” is free to read here on the web, and the Django Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Django Academy course, upgrade to CoddyKit PRO.
What will I learn in “DEBUG, SECRET_KEY, and ALLOWED_HOSTS”?
Get the dangerous settings right. You practise Django Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Django Academy?
No prior experience is required. Django Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “DEBUG, SECRET_KEY, and ALLOWED_HOSTS” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Django Academy lesson?
Yes. Every Django Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- DEBUG, SECRET_KEY, and ALLOWED_HOSTS
- HTTPS, HSTS, and Secure Cookies
- XSS, CSRF, and SQL Injection Defenses
- Running the Deployment Checklist