# Production release gate — Online Family CMS

Every item must be marked PASS with evidence before production release.

- [ ] Approved baseline is confirmed to match live production.
- [ ] Staging subdomain has valid HTTPS; canonical hostname and redirects verified.
- [ ] PHP version and required extensions verified on actual cPanel.
- [ ] Dedicated staging DB user, least privilege, secret configuration outside document root.
- [ ] Owner login, password policy, session security, logout and rate limits tested.
- [ ] Server-side authorization verified for every write endpoint.
- [ ] CSRF, XSS/sanitization, SQL injection, upload MIME/size/path traversal tested.
- [ ] Uploads restricted to safe image formats; SVG policy reviewed; WebP conversion tested.
- [ ] 77 article source records imported and reconciled; all original slugs retained.
- [ ] 474 media source files imported and checksums reconciled; references resolve.
- [ ] Drafts remain private; publishing actually updates public rendering; rollback verified.
- [ ] URL changes require approval and redirects avoid loops/chains.
- [ ] Backup includes DB AND uploaded media; restore performed in isolated environment.
- [ ] Contact form HTTP 500 issue tested end-to-end; email delivery verified.
- [ ] Visual regression screenshots compared at 320, 375, 768, 1024, 1280 widths.
- [ ] Keyboard/accessibility, metadata/canonical, sitemap/robots, internal links tested.
- [ ] Error logs contain no secrets; production error display disabled.
- [ ] Rollback instructions tested and known-good site backup retained.
- [ ] Final approval recorded before replacing any production files.

Current known blocker: CMS content publishing is not yet proven to update the existing static public HTML files. Do not deploy as a fully integrated CMS until this is resolved.