# Production Checklist
- HTTPS enabled and HTTP redirected to HTTPS
- Public document root points to `/public`
- Strong Super Admin password
- Dedicated MySQL user
- `install.php` removed/renamed after setup
- Backups configured
- SMTP/email notifications can be added in a later communications phase
- Server timezone configured correctly
- File permissions: config/storage writable only where required
- PHP display_errors disabled in production
- Web application firewall/rate limiting enabled where available