## Launch Checklist

Use this checklist before exposing the site to production traffic.

### 1. Security & Authentication
- [ ] Configure real admin credentials in `admin_login.php` (move secrets to environment variables or a secure store).
- [ ] Set `ADMIN_USERNAME`, `ADMIN_PASSWORD_HASH`, and `ADMIN_EMAIL` in your `.env` file (generate the hash with `php -r "echo password_hash('yourpass', PASSWORD_DEFAULT), PHP_EOL;"`).
- [ ] Verify every admin page loads through `require_admin_login()` (no remaining session bypass code).
- [ ] Enforce HTTPS at the web server level and confirm session cookies are marked `Secure` / `HttpOnly`.

### 2. Data Hygiene
- [ ] Remove any analytics seed data by running  
  `php scripts/cleanup_seed_analytics.php`
- [ ] Clear staging content that should not ship (draft articles, placeholder images, etc.).

### 3. Configuration
- [ ] Update `config/environment.php` with production database, mail, and CDN settings.
- [ ] Set `MEMBERSHIP_ENABLED` and related monetisation toggles (`src/includes/config.php`) according to the launch plan.
- [ ] Fill in real tracking IDs (`seo.google_analytics_id`, etc.) via the admin settings UI.

### 4. Functional Verification
- [ ] Smoke-test core flows: sign-up, login, article CRUD, subscription purchase, payment webhook.
- [ ] Validate admin dashboards show live (non-seeded) metrics after cleanup.
- [ ] Review logs (`admin_logs.php`) for unexpected warnings or errors.

### 5. Operations
- [ ] Back up the database and `config/` directory before deployment.
- [ ] Configure monitoring/alerting for uptime and error rates.
- [ ] Document rollback steps and on-call contacts.

Tick every item before going live to minimise surprises on launch day.
