Security checklist (manage.py check --deploy) in Django - Step-by-Step Execution

Concept Flow - Security checklist (manage.py check --deploy)

Run manage.py check --deploy

↓

Django runs security checks

↓

Check settings for security issues

↓

Report warnings or pass

↓

Fix reported issues

↓

Re-run check until no warnings

This flow shows how running the command triggers Django to check your project settings for common security issues and report warnings to fix.

Execution Sample

Django

python manage.py check --deploy

Runs Django's deployment security checks and reports any security warnings.

Execution Table

Step	Check Performed	Setting Checked	Result	Action Suggested
1	Check DEBUG mode	DEBUG	Warning: DEBUG=True	Set DEBUG=False for production
2	Check ALLOWED_HOSTS	ALLOWED_HOSTS	Warning: ALLOWED_HOSTS is empty	Add your domain names to ALLOWED_HOSTS
3	Check SECRET_KEY	SECRET_KEY	OK	No action needed
4	Check CSRF_COOKIE_SECURE	CSRF_COOKIE_SECURE	Warning: False	Set CSRF_COOKIE_SECURE=True
5	Check SESSION_COOKIE_SECURE	SESSION_COOKIE_SECURE	Warning: False	Set SESSION_COOKIE_SECURE=True
6	Check SECURE_HSTS_SECONDS	SECURE_HSTS_SECONDS	Warning: 0	Set SECURE_HSTS_SECONDS > 0
7	Check SECURE_CONTENT_TYPE_NOSNIFF	SECURE_CONTENT_TYPE_NOSNIFF	Warning: False	Set SECURE_CONTENT_TYPE_NOSNIFF=True
8	Check SECURE_BROWSER_XSS_FILTER	SECURE_BROWSER_XSS_FILTER	Warning: False	Set SECURE_BROWSER_XSS_FILTER=True
9	Check SECURE_SSL_REDIRECT	SECURE_SSL_REDIRECT	Warning: False	Set SECURE_SSL_REDIRECT=True
10	Check X_FRAME_OPTIONS	X_FRAME_OPTIONS	OK	No action needed
11	Check CSRF_COOKIE_HTTPONLY	CSRF_COOKIE_HTTPONLY	Warning: False	Set CSRF_COOKIE_HTTPONLY=True
12	Check SESSION_COOKIE_HTTPONLY	SESSION_COOKIE_HTTPONLY	OK	No action needed
13	Check SECURE_REFERRER_POLICY	SECURE_REFERRER_POLICY	Warning: Not set	Set SECURE_REFERRER_POLICY to a safe value
14	Check SECURE_PROXY_SSL_HEADER	SECURE_PROXY_SSL_HEADER	Warning: Not set	Set SECURE_PROXY_SSL_HEADER if behind proxy
15	Check default password validators	AUTH_PASSWORD_VALIDATORS	OK	No action needed
16	Summary	All checks	Warnings found	Fix all warnings before deployment

💡 Checks complete; warnings indicate settings to fix for secure deployment

Variable Tracker

Setting	Initial Value	After Fix 1	After Fix 2	Final
DEBUG	True	False	False	False
ALLOWED_HOSTS	[]	['example.com']	['example.com']	['example.com']
CSRF_COOKIE_SECURE	False	True	True	True
SESSION_COOKIE_SECURE	False	True	True	True
SECURE_HSTS_SECONDS	0	3600	3600	3600
SECURE_CONTENT_TYPE_NOSNIFF	False	True	True	True
SECURE_BROWSER_XSS_FILTER	False	True	True	True
SECURE_SSL_REDIRECT	False	True	True	True
CSRF_COOKIE_HTTPONLY	False	True	True	True
SECURE_REFERRER_POLICY	None	'no-referrer'	'no-referrer'	'no-referrer'
SECURE_PROXY_SSL_HEADER	None	('HTTP_X_FORWARDED_PROTO', 'https')	('HTTP_X_FORWARDED_PROTO', 'https')	('HTTP_X_FORWARDED_PROTO', 'https')

Key Moments - 3 Insights

Why does the check warn if DEBUG is True?

DEBUG=True shows detailed error pages to users, which can leak sensitive info. The execution_table row 1 shows this warning and suggests setting DEBUG=False for safety.

What happens if ALLOWED_HOSTS is empty?

An empty ALLOWED_HOSTS means Django will reject all incoming requests in production. Row 2 in the execution_table warns about this and suggests adding your domain names.

Why set CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True?

These settings ensure cookies are only sent over HTTPS, protecting them from being intercepted. Rows 4 and 5 show warnings if these are False.

Visual Quiz - 3 Questions

Look at the execution_table at step 6, what is the value of SECURE_HSTS_SECONDS?

A 0

B 3600

C True

D Not set

💡 Hint

Check the 'Result' column in row 6 of the execution_table.

At which step does Django check if SESSION_COOKIE_SECURE is set correctly?

A Step 3

B Step 9

C Step 5

D Step 12

💡 Hint

Look for SESSION_COOKIE_SECURE in the 'Setting Checked' column.

If you fix DEBUG to False, how does the variable_tracker show this change?

A DEBUG stays True

B DEBUG changes from True to False after Fix 1

C DEBUG changes from False to True after Fix 1

D DEBUG is removed

💡 Hint

Check the 'DEBUG' row in variable_tracker from 'Initial Value' to 'After Fix 1'.

Concept Snapshot

Run 'manage.py check --deploy' to scan your Django settings for security issues.
It checks DEBUG, ALLOWED_HOSTS, cookie security, SSL settings, and more.
Warnings tell you what to fix before deploying.
Fix all warnings to make your app safer in production.
Re-run the check until no warnings remain.

Full Transcript

The 'manage.py check --deploy' command runs a series of security checks on your Django project settings. It looks for common mistakes like leaving DEBUG mode on, not setting ALLOWED_HOSTS, or missing secure cookie flags. Each check reports if the setting is safe or needs fixing. For example, DEBUG should be False in production to avoid exposing sensitive info. ALLOWED_HOSTS must list your domain names to accept requests. Secure cookie settings ensure cookies are sent only over HTTPS. The command outputs warnings for each issue found. You fix these in your settings.py file and run the command again until no warnings remain. This helps you prepare your Django app for safe deployment.