# Production Checklist

## Completed

- Relative `.htaccess` routing keeps local `/strong-tower/` and production root compatible.
- Pretty blog route `/blogs/{slug}` now maps to `blog-single.php?slug={slug}`.
- Unknown routes are served by `404.php` with a real 404 status.
- Sensitive files are blocked by `.htaccess`.
- `cache/`, `logs/`, `uploads/`, and `uploads/resumes/` have directory protection.
- Public sessions are opt-in; the homepage no longer needs to start a session.
- Admin/referral sessions still use HttpOnly, Secure when HTTPS, SameSite Strict, idle timeout, and regeneration.
- Public forms save database records before email notification.
- Public forms now include CSRF, honeypot, rate limiting, and duplicate-submission locking.
- Resume uploads validate extension, MIME, magic bytes, and DOCX structure.
- WebP image derivatives generated for migrated media.
- Production ZIP excludes local setup script, logs, cache payloads, `.DS_Store`, and temporary files.

## Verify On Hosting

- Confirm PHP extensions: PDO MySQL, fileinfo, ZipArchive.
- Confirm `cache/`, `logs/`, and `uploads/resumes/` are writable.
- Confirm `/config.php`, `/database.sql`, `/.env`, `/logs/`, and `/uploads/resumes/` are not publicly readable.
- Create a non-default first admin by SQL hash import.
- Submit contact, request-care, support, testimonial, referral, and job forms.
- Confirm admin secure resume download works only after login.

## Shared Hosting Limits

- Load tests on shared hosting may trigger host throttling.
- `mail()` behavior depends on cPanel mail routing and SPF/DKIM setup.
- Environment variables may not be available on all cPanel plans; fallback constants are provided in `config.php`.

