Django Security Checklist

Security is a critical aspect of web development. Django provides many security features out of the box, but you need to configure them correctly.

Essential security settings for production:

- Set SECRET_KEY from environment variable (never hardcode)
- Set DEBUG = False
- Configure ALLOWED_HOSTS
- Enable SECURE_SSL_REDIRECT, SECURE_HSTS_SECONDS
- Set SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE
- Use parameterized queries (never raw SQL with string formatting)
- Validate and sanitize all user input
- Keep dependencies updated

Django's built-in protections include CSRF tokens, XSS prevention via template auto-escaping, clickjacking protection, and SQL injection prevention through the ORM.