Production baseline

  • Use a supported PHP version and install security updates.
  • Serve the entire platform through HTTPS.
  • Disable directory listing.
  • Use restrictive file and folder permissions.
  • Keep configuration files outside public access whenever the hosting setup permits it.
  • Disable verbose error output in production.

Secrets and configuration

API keys, database passwords and administrator secrets must never be committed to public repositories or included in screenshots and support messages.

Updates

Test updates in a safe copy before replacing the live installation. Create a verified backup before every important deployment.

Do not edit production blindly

Avoid making untested changes directly on the live server. A small syntax or configuration error can interrupt access for every user.