# Production deployment checklist

## Before upload

- [ ] Existing files and database backed up
- [ ] Staging domain available
- [ ] PHP 8.1+ and required extensions confirmed
- [ ] Database and least-privilege application user created
- [ ] Unique APP_KEY generated
- [ ] Production URL and database credentials configured
- [ ] `APP_DEBUG` disabled

## Installation

- [ ] Public and private directories placed correctly
- [ ] Writable storage/upload permissions verified without `0777`
- [ ] Installer completed once
- [ ] First Super Admin login confirmed
- [ ] Installer directory removed

## Functional QA

- [ ] All public pages return 200
- [ ] Missing route returns 404
- [ ] Contact, quote, and newsletter records saved
- [ ] Admin sections protected from guests
- [ ] Logout destroys the session
- [ ] Role permissions tested
- [ ] Media MIME restrictions tested
- [ ] Backup create and staging restore tested

## UX, performance, and SEO

- [ ] Desktop, laptop, tablet, and mobile layouts checked
- [ ] Keyboard navigation and visible focus checked
- [ ] Dark/light theme and animations checked
- [ ] Images lazy-load where appropriate
- [ ] Compression and static cache headers confirmed
- [ ] Canonicals, descriptions, Open Graph, Twitter cards, JSON-LD checked
- [ ] `robots.txt` and `sitemap.xml` checked
- [ ] HTTPS, HSTS, CSP, and other security headers checked

## Launch

- [ ] DNS and SSL verified
- [ ] Cloudflare Full (strict), caching, and WAF reviewed
- [ ] Browser/server/CDN caches cleared
- [ ] Production smoke test complete
- [ ] Off-site backup schedule confirmed