Running the Deployment Checklist
Audit settings with manage.py check --deploy.
Running the Deployment Checklist is a free Django Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Django Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
One Command to Audit Everything
Django ships a built-in security auditor. The deployment checklist scans your settings and warns you about anything unsafe before launch day. ✅
Run check --deploy
Run the check command with the deploy flag. It activates extra security checks that normal checks skip, printing warnings you can act on.
python manage.py check --deployReading the Warnings
Each warning has a code like security.W008 and a clear message. Use the code to look up exactly which setting to fix in the docs.
Check the Right Settings
Point the checker at your production config, not your dev one. Set DJANGO_SETTINGS_MODULE so it audits the file that will actually run live.
DJANGO_SETTINGS_MODULE=config.settings.prod python manage.py check --deployIt Flags DEBUG
If DEBUG is still True, the check shouts about it. A live site with DEBUG on leaks tracebacks and settings, so this is a hard stop.
It Flags Insecure Cookies
The checklist warns when SESSION_COOKIE_SECURE or CSRF_COOKIE_SECURE is off, reminding you to keep auth cookies on HTTPS only.
It Flags Missing HSTS
A zero SECURE_HSTS_SECONDS or missing SSL redirect triggers warnings too. The check nudges you toward forcing encrypted connections everywhere.
Silencing False Positives
A few warnings may not fit your setup. You can quiet specific ones with SILENCED_SYSTEM_CHECKS, but only after you truly understand each.
SILENCED_SYSTEM_CHECKS = ["security.W004"]Make It Fail the Build
Treat warnings as errors in CI by adding --fail-level. Now a risky setting breaks the pipeline instead of slipping into production.
python manage.py check --deploy --fail-level WARNINGMake It a Habit
Run the checklist on every release, not just the first. New apps and settings can quietly reintroduce risks the audit will catch for you.
Pair It With Other Checks
The deploy check is one layer. Run your tests and collectstatic in the same release step so code, assets, and security all get verified together.
Quick Check
Last question of the lesson, then a recap.
Recap: Ship With Confidence
You learned to run check --deploy, read its warning codes, point it at prod settings, and even fail CI on risk. Audit every release and ship with confidence. 🚀
Frequently asked questions
Is the “Running the Deployment Checklist” lesson free?
Yes — the full text of “Running the Deployment Checklist” is free to read here on the web, and the Django Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Django Academy course, upgrade to CoddyKit PRO.
What will I learn in “Running the Deployment Checklist”?
Audit settings with manage.py check --deploy. You practise Django Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Django Academy?
No prior experience is required. Django Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Running the Deployment Checklist” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Django Academy lesson?
Yes. Every Django Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- DEBUG, SECRET_KEY, and ALLOWED_HOSTS
- HTTPS, HSTS, and Secure Cookies
- XSS, CSRF, and SQL Injection Defenses
- Running the Deployment Checklist