Settings That Matter

DEBUG must be False in production. With it on, an error page shows your settings, your file paths, your installed packages and often your queries, to whoever triggered it. That includes anyone who can reach a URL that raises.

This is not obscure. It is the single most common serious misconfiguration in deployed Django sites.

The secret key signs sessions and password reset tokens. Someone with it can forge both. It belongs in an environment variable, never in settings.py, and never in git.

If it has been committed, rotate it. Removing the commit does not help: it is in the history, and history is public on a public repository.

Django will audit this for you. python manage.py check --deploy inspects your settings and explains every warning it raises. Run it before your first deployment and again whenever settings change. It catches the things nobody remembers: secure cookies, HSTS, ALLOWED_HOSTS, SSL redirect.

✦ Environment, not conditionals

Settings that differ between development and production should come from environment variables, not from an if in settings.py. A conditional means production behavior depends on a variable that also exists in development, and eventually the two get out of step in a way nobody notices until something is exposed.