# Security Checklist

Before production use:

- Use HTTPS only.
- Keep PHP updated.
- Use a strong cPanel password and database password.
- Deploy with document root set to `public_html` only.
- Do not expose `/app`, `/config`, `/database`, or `/storage` as public web folders.
- Delete or restrict `public_html/install` after installation if your hosting workflow allows it. The installer is automatically locked by `storage/installer.lock`.
- Configure SMTP from a real domain email account.
- Enable country blocking only after confirming Cloudflare `CF-IPCountry` is available.
- Keep regular cPanel account backups.
- Review Activity Logs regularly.
- Disable unused modules.

## Recommended file permissions

Directories: `755`
Files: `644`
`config/config.php`: `640` where hosting allows.

## Country blocking limitation

Application-level country blocking needs a trusted country code header. Cloudflare `CF-IPCountry` is recommended. Do not trust random user-supplied country headers unless they are set by a trusted proxy.