Going Live

runserver is not for production. It is single-threaded, unhardened, and says so in its own output. Production means an application server such as gunicorn, usually behind a web server or a platform that provides one.

Django does not serve static files when DEBUG is False. This surprises everyone once: the site deploys, works, and has no CSS.

collectstatic gathers every app's static files into one directory. Then either WhiteNoise serves them from the application, or your host serves that directory directly. Both are fine; you must choose one.

The deployment checklist.

requirements.txt committed and current.

SECRET_KEY, DEBUG and the database from the environment.

ALLOWED_HOSTS set to your actual domain.

check --deploy clean, or every warning explained.

Migrations run as part of deploying, not by hand afterwards.

collectstatic run and static files actually served.

A superuser created on the production database.

An error page that is not a stack trace.

Then visit it as a stranger would: signed out, on a phone, and try to reach something you should not be allowed to see.