Production-Readiness Checklist

Twenty-four checks that separate a system you can sleep on from one that pages you at 2am. Work through them before you call anything done.

Infrastructure

• The server is correctly sized for real traffic, not guessed at.
• PHP, web server, and database versions are current and supported.
• DNS records are documented and email authentication (SPF, DKIM, DMARC) is in place.
• SSL is valid and renews automatically, with no mixed-content warnings.
• A staging environment mirrors production closely enough to trust.
• Deployments follow a defined process with a clear rollback path.

Security

• Admin logins are protected with strong credentials and two-factor authentication.
• A firewall or WAF is active and rate limiting blocks brute-force attempts.
• File and directory permissions are locked down, not left at defaults.
• Core, plugins, and themes are on a patch schedule, not updated ad hoc.
• Security headers are set and verified.
• An incident response plan exists and names who does what.

Performance

• Core Web Vitals (LCP, INP, CLS) are measured and within target.
• Images are optimised and served at the right dimensions.
• Caching is configured at the page, object, and edge layers as appropriate.
• Render-blocking assets are minimised and non-critical scripts deferred.
• The database is clean, indexed, and free of orphaned data.
• A CDN serves static assets close to your audience.

Operations

• Uptime and error monitoring alert you before clients notice a problem.
• Backups run automatically and have been restored at least once to prove they work.
• Every system and credential is documented somewhere your team can find it.
• Analytics capture the events that actually inform business decisions.
• There is a single owner for the system, not a diffuse "someone should".
• A maintenance routine is scheduled, not left to whenever something breaks.