How do you deploy a Django application to production?

Question

Accepted Answer

Deploying Django to production involves running it behind a proper **WSGI/ASGI server** and **web server**, serving static files correctly, securing settings, and managing the database — quite different from the built-in development server (which is **not** for production).

## The production stack

```text
Client → NGINX (web server) → GUNICORN (WSGI app server) → DJANGO
           │                      (runs your Python app, multiple workers)
           └─ serves static/media files directly (efficient)

❌ NEVER use `python manage.py runserver` in production — it's single-threaded,
   insecure, and not built for load. Use Gunicorn (WSGI) or Uvicorn (ASGI for async).
```

The dev server is unsuitable for production. The standard stack: an **application server** (Gunicorn/uWSGI for WSGI, Uvicorn for ASGI/async) runs Django with multiple workers, behind a **web server** (nginx) that handles incoming connections, TLS, and static files.

## Production settings (security-critical)

```python
DEBUG = False                            # ❗ MUST be False — DEBUG=True leaks sensitive info
ALLOWED_HOSTS = ["example.com"]          # required when DEBUG=False
SECRET_KEY = os.environ["SECRET_KEY"]    # from the environment, NOT committed
SECURE_SSL_REDIRECT = True               # force HTTPS
SESSION_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 31536000
```

## Static files

```bash
python manage.py collectstatic           # gather static files into STATIC_ROOT
# then serve them via nginx or a CDN — or use WhiteNoise to serve them from the app
# (Django does NOT serve static files itself in production)
```

## Database and migrations

```bash
python manage.py migrate                  # apply migrations to the production DB
# use a real database (PostgreSQL), connection pooling, regular backups
```

## A typical deployment checklist

```text
1. Set production environment variables (SECRET_KEY, DB credentials, DEBUG=False)
2. Run migrations (manage.py migrate)
3. Collect static files (collectstatic) → serve via nginx/CDN/WhiteNoise
4. Run the app with Gunicorn/Uvicorn (multiple workers, behind nginx)
5. Enable HTTPS (TLS certificates, e.g. Let's Encrypt)
6. Set up logging, error monitoring (Sentry), health checks
7. Add a process manager (systemd/supervisor) or use containers (Docker) + orchestration
8. Run `manage.py check --deploy` to audit security settings
```

## Modern deployment approaches

```text
✓ Containers (Docker) + orchestration (Kubernetes) or platforms (Heroku, Railway, Render)
✓ Managed databases, separate static/media storage (S3 + CDN)
✓ Background workers (Celery) + a broker (Redis) as separate services
✓ Horizontal scaling: multiple app instances behind a load balancer (keep app STATELESS)
```

## Why it matters

Deploying Django to production correctly is essential knowledge for taking applications from development to real-world use, and it involves important considerations that differ fundamentally from local development — getting it wrong leads to security vulnerabilities, poor performance, or broken applications.

Understanding the **production stack** is foundational: the built-in development server (`runserver`) is explicitly not for production (it's single-threaded, insecure, and can't handle load), so you must run Django behind a proper **application server** (Gunicorn/uWSGI for WSGI, or Uvicorn for ASGI/async) with multiple workers, fronted by a **web server** (nginx) handling connections, TLS, and static file serving.

Several aspects are security- and correctness-critical: **production settings** (especially `DEBUG=False`, which is mandatory since `DEBUG=True` leaks sensitive tracebacks and configuration to attackers, plus `ALLOWED_HOSTS`, a secret `SECRET_KEY` from the environment, and HTTPS enforcement), **static file handling** (running `collectstatic` and serving files via nginx/CDN/WhiteNoise, since Django doesn't serve them itself in production — a common deployment failure), and **database management** (a real database like PostgreSQL, applying migrations, backups).

Knowing the deployment checklist, modern approaches (Docker/containers, managed platforms, cloud storage for media, Celery workers as separate services, horizontal scaling with a stateless app), and the operational concerns (logging, monitoring with Sentry, health checks, process management) is what separates a working production deployment from a fragile or insecure one.

Because every real Django application must eventually be deployed, and because deployment mistakes (leaving `DEBUG=True`, mishandling static files, exposing secrets, using the dev server) cause real security and reliability problems, understanding how to deploy Django properly — the stack, the security-critical settings, static/media handling, and modern deployment practices — is important, high-stakes knowledge that reflects the ability to ship production-ready applications, a frequently-relevant and professionally-essential topic for any Django developer responsible for live systems.