Security & Production Checklist

Before launch

• Use HTTPS.
• Use a strong unique Admin password.
• Keep PHP and MySQL/MariaDB supported and updated.
• Protect database credentials and config/config.php.
• Configure authenticated SMTP where possible.
• Enable Cloudflare Turnstile if spam is a concern.
• Review public business/contact information.
• Test customer booking, manage, reschedule and cancellation links.
• Confirm blocked periods cannot be booked.
• Confirm Planning capacity behaves as expected.
• Verify the correct timezone.
• Configure reminder cron if reminders are enabled.
• Review System Health.

Backups

Back up the database and application files before updates or server migrations. Booking/customer information is operational business data and should be included in the normal hosting backup strategy.

Updates

Keep a backup before replacing application files. Do not overwrite a working installation with an unrelated clean-install config/config.php.

License movement

Deactivate the current installation before reusing its license on another domain.