Security checklist (manage.py check --deploy) in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the manage.py check --deploy command in Django?

It runs a security-focused system check to find common deployment issues and suggests fixes to make your Django app safer in production.

beginner

Name two security settings that manage.py check --deploy verifies.

It checks if DEBUG is set to False and if SECURE_SSL_REDIRECT is enabled to force HTTPS connections.

beginner

Why should DEBUG be set to False in production according to the security checklist?

Because DEBUG=True shows detailed error pages that can leak sensitive information to attackers.

intermediate

What does the SECURE_HSTS_SECONDS setting control, and why is it important?

It sets how long browsers should only use HTTPS for your site, helping prevent man-in-the-middle attacks by enforcing secure connections.

beginner

What does the security check say about ALLOWED_HOSTS?

It must be set to a list of valid host/domain names your site can serve to prevent HTTP Host header attacks.

What does manage.py check --deploy primarily check for?

A Template syntax errors

B Database schema errors

C Performance bottlenecks

D Security and deployment best practices

The command focuses on security and deployment settings to ensure your app is safe for production.

Which setting should NOT be True in production according to the checklist?

A SECURE_HSTS_SECONDS

B SECURE_SSL_REDIRECT

C DEBUG

D ALLOWED_HOSTS

DEBUG must be False in production to avoid leaking sensitive info.

What is the role of SECURE_SSL_REDIRECT?

A Redirect HTTP requests to HTTPS

B Disable SSL encryption

C Enable debug mode

D Allow all hosts

It forces all HTTP requests to redirect to HTTPS for secure communication.

Why must ALLOWED_HOSTS be set properly?

A To prevent HTTP Host header attacks

B To enable debug mode

C To allow database connections

D To disable SSL

Setting ALLOWED_HOSTS restricts which hosts your app will serve, blocking host header attacks.

What does SECURE_HSTS_SECONDS help enforce?

A Disabling cookies

B HTTPS-only connections for a set time

C Allowing HTTP connections

D Enabling debug info

It tells browsers to only use HTTPS for your site for the specified time, improving security.

Explain the main security checks performed by manage.py check --deploy and why they matter.

Think about what settings protect your app from common attacks and leaks.

Describe how you would fix a warning about ALLOWED_HOSTS from the deployment check.

Consider what hosts your app should trust and serve.