# Production Deployment Checklist

## DNS / Cloudflare
- [ ] DNS points to production server
- [ ] SSL/TLS Full (strict)
- [ ] WAF enabled
- [ ] Bot protection/rate limiting configured
- [ ] Admin path protected by strong authentication policy

## Application
- [ ] APP_DEBUG=false
- [ ] APP_KEY generated
- [ ] Production APP_URL configured
- [ ] MySQL credentials configured
- [ ] Storage symlink created
- [ ] Queue worker configured
- [ ] Scheduler/cron configured if scheduled publishing is enabled
- [ ] Cache/config/routes optimized

## Google
- [ ] reCAPTCHA v3 site key configured
- [ ] reCAPTCHA secret key configured
- [ ] Correct domains registered in reCAPTCHA console
- [ ] Google Maps embed/directions configured
- [ ] Google Analytics configured
- [ ] Google Search Console verified

## Email
- [ ] SMTP configured
- [ ] SPF configured
- [ ] DKIM configured
- [ ] DMARC configured
- [ ] Enquiry notification tested
- [ ] Quote notification tested

## CMS
- [ ] Strong admin password
- [ ] Admin MFA/2FA enabled
- [ ] Least-privilege roles configured
- [ ] Test editor cannot access administration settings
- [ ] File upload restrictions tested
- [ ] Backup/restore tested
- [ ] Audit logging enabled

## Forms
- [ ] Contact form tested
- [ ] Quote form tested
- [ ] reCAPTCHA score rejection tested
- [ ] Honeypot tested
- [ ] Rate limiting tested
- [ ] Validation tested
- [ ] Confirmation emails tested

## Content
- [x] Exact office address approved
- [ ] Google Maps pin verified on-site / in Google Maps
- [ ] Real client testimonials approved
- [ ] Real client logos approved
- [ ] Business claims/statistics verified
- [ ] Legacy platform references removed