After install
/install returns 404 once the lock file exists. Do not delete that lock on a live instance. Keep the generated admin path private.
Operations
- Terminate TLS at the reverse proxy; do not expose the app on plain HTTP in production. HSTS, firewall, and extra security headers are your responsibility — the app does not set them globally.
- Back up the database and
storage/on a schedule you have tested restoring. - Keep PHP 8.3+ and Composer dependencies updated.
- Run cron so SSL checks, reminders, and mail actually fire.
- Use SMTP for real mail; the log driver does not send messages.