Page

Production readiness

HTTPS, admin path, installer cleanup, writable folders, backups, SMTP, payment testing, and final launch checks.

Before launch

• Use HTTPS before handling real customer data.
• Set APP_ENV=production in .env.
• Set Site URL to the final HTTPS storefront URL.
• Change the Admin URL path in Settings if you want a private admin route.
• Confirm public/install.php is deleted or blocked and storage/installed.lock exists.

Server permissions

• The web server should point to the public folder, not the project root.
• Only storage and public/uploads should be writable by PHP.
• Digital files should remain in storage/downloads, outside public web access.

Operational checks

• Confirm SMTP sends order, download, contact, and password reset emails.
• Test payment sandbox orders before live keys.
• Place test orders for physical products, digital products, variants, options, coupons, tax, and shipping.
• Set up database and file backups before taking real orders.
• Use the performance test catalog when you need to prove larger catalog speed, then delete the generated test catalog before launch.
• Use the Launch Cleanup panel to confirm demo admin access, test catalog data, installer access, payment mode, email delivery, and contact protection.
• The contact form always uses CSRF, rate limiting, a hidden honeypot field, and a minimum submit time. Enable the simple challenge in Store Settings only if spam becomes a problem.