Ten things we check before a Laravel app goes live

Before any Laravel project of ours goes to production, it goes through the same checklist. Here it is, so yours can too.

1. APP_DEBUG is false and APP_ENV is production.
2. Every URL is HTTPS and the app trusts the proxy in front of it.
3. Uploaded and paid files sit on a private disk, never in public.
4. The queue worker is running, and something restarts it when it dies.
5. The scheduler is in cron.
6. Mail is sent from a real mailbox with SPF and DKIM, not from the server.
7. Backups exist, and someone has actually restored one.
8. Rate limits sit on login, contact and payment routes.
9. Error pages are branded and errors go somewhere a human sees.
10. The .env is not in the repository, and never was.

Our deploy check command runs most of these automatically. The last two need a person.