Confirm database migrations are applied and use the production settings deliberately. Plan a separate administrator recovery path and protect the email address used for account recovery.

1. Create the initial authorised administrator with python manage.py createsuperuser in the application environment. Enter credentials through the prompt rather than placing a password in a recorded command.

2. Serve the interface over HTTPS and verify secure session behavior. Keep development debugging disabled.

3. Create ordinary staff accounts and assign appropriate groups and model permissions. Reserve superuser access for the small number of people who actually need all permissions.

4. Review third-party authentication or MFA extensions for maintenance and compatibility before enabling them. Django core configuration alone should not be assumed to provide every extra login control.

5. Test the administrator role and a limited staff role separately. Record account ownership and remove access promptly when a team member leaves.

Confirm the limited account can perform its intended task and cannot access unrelated customer or configuration data. Test the documented account recovery process with an authorised test account.

If login fails, check active and staff status, authentication backend, cookies and HTTPS handling. Use the supported password change command for authorised recovery rather than editing password hashes manually.

• Setting Django production settings and secret keys
• Using Django email backends for password resets
• Maintaining Django sessions and scheduled cleanup
• Choosing WSGI or ASGI for Django hosting

• Django authentication
• Django administrator