Go-live checklist

Work through this list top to bottom on a fresh production install before handing it to a client or pointing real ad spend at it. Every item is verifiable from the app or the server; nothing here is theoretical.

Who this is for#

• Super-admin / hosting admin — running the launch.
• Support / account manager — auditing a deployment someone else built.

Prerequisites: completed cPanel deployment walkthrough and Domain, subdomain & SSL.

1. Application & server#

• [ ] PHP 8.4 selected for the domain; all required extensions green in the installer / php -v
• [ ] Document root points at public/ — or the subfolder bridge works (/crm/login loads)
• [ ] APP_ENV=production and APP_DEBUG=false in .env
• [ ] APP_URL matches the real HTTPS URL exactly (no trailing slash, includes subfolder if any)
• [ ] APP_KEY set (installer did it; changing it later breaks encrypted data)
• [ ] php artisan storage:link ran — logos/attachments/recordings serve correctly
• [ ] storage/ and bootstrap/cache/ writable (775), no permission errors in laravel.log
• [ ] php artisan optimize:clear run after the last .env edit

2. Database#

• [ ] Dedicated DB user with rights on only this database
• [ ] Migrations all Ran (php artisan migrate:status or installer finished)
• [ ] Base seeders applied (roles/permissions/plans); no demo seeders on production
• [ ] GET /api/v1/health shows checks.db: "ok"

3. Security#

• [ ] HTTPS certificate live; Force HTTPS on
• [ ] Session hardening enabled on HTTPS: SESSION_SECURE_COOKIE=true, SESSION_HTTP_ONLY=true, SESSION_SAME_SITE=lax
• [ ] TRUSTED_PROXIES set correctly if behind Cloudflare/host proxy
• [ ] SA_IP_ALLOWLIST considered for the platform panels (optional but recommended)
• [ ] SECURITY_ENFORCE_2FA decision made for platform staff
• [ ] All default/demo passwords changed; owner account uses a strong password
• [ ] LEADHUB_DEMO_MODE off
• [ ] .env not readable over HTTP (dotfile blocks active)
• [ ] storage/installed.lock present (installer cannot re-run)

4. Email#

• [ ] SMTP configured in Settings (host, port, user, password, from-address)
• [ ] Test e-mail sends and arrives (check the spam folder; SPF/DKIM at the domain if it lands there)
• [ ] A test invitation reaches a real inbox

5. Meta (Facebook) lead ads#

• [ ] Platform app credentials saved in Super Admin → Settings → Meta Developer (health card green)
• [ ] OAuth redirect URI pasted into the Meta app dashboard
• [ ] Test tenant connected via OAuth; Page + Ad Account selected
• [ ] Lead forms selected (only selected forms ingest) and field mapping verified
• [ ] End-to-end test lead submitted from a real form and visible in the workspace within a minute
• [ ] Webhook log shows the delivery (pending/processed), not invalid_signature
• [ ] leadhub:meta-health task has run at least once (every 6 h)

6. WhatsApp#

• [ ] WABA / phone number connected in workspace settings
• [ ] Callback URL + verify token pasted into Meta and verified (handshake returns the challenge)
• [ ] App secret present so X-Hub-Signature-256 is verified
• [ ] Message templates approved and their statuses synced
• [ ] Test inbound message appears in the inbox; test outbound template sends
• [ ] STOP keyword opt-out verified on a test number

7. Payments (only if commercial billing is live)#

• [ ] Razorpay/Cashfree keys + webhook secret saved in Super Admin → Billing → Providers & Settings
• [ ] Webhook URLs registered at the provider
• [ ] Test payment completes; invoice + payment records update
• [ ] Allowlist RESTRICTED lifecycle screens (grace → restriction) reviewed with the client

8. Mobile app#

• [ ] Mobile server URL points at https://…/api/v1/mobile/ (trailing slash) — in the distributed build and/or via Advanced → Server URL
• [ ] POST /api/v1/mobile/login succeeds with a real agent account
• [ ] Push token registered (device/register) and a test push arrives
• [ ] Offline queue syncs after reconnect; Device Health screen shows a sane state

9. Cron & queue#

• [ ] Exactly one scheduler entry present (or the cron.php variant), running every minute
• [ ] Queue drained: jobs table does not grow unbounded; a test e-mail sent while watching the log fires its job
• [ ] failed_jobs inspected — recurring failures understood before launch
• [ ] queue:restart run after the final deploy

10. Backups#

• [ ] One manual backup created and verified (smoke test)
• [ ] Nightly backup toggle decision made; if on, next 02:00 run confirmed
• [ ] Prune/retention chosen and an off-site copy downloaded
• [ ] Restore procedure documented for whoever is on call (see Backups & restore)

11. Monitoring & ops#

• [ ] Uptime monitor pointed at /api/v1/health (expects 200 ok; 503 means degraded)
• [ ] LOG_LEVEL sensible (error or warning); log rotation/disk watched
• [ ] Daily-checks habit agreed (Daily checks)
• [ ] leadhub:check-updates (or the in-app updater) used to confirm the version before hand-off

Sign-off#

Common mistakes#

• Skipping the end-to-end test lead, then discovering field mapping is wrong during a live campaign.
• Launching with cron missing — nothing time-based works, including backups.
• Leaving APP_DEBUG=true "just for launch week".
• No off-site backup copy.
• Handing over before the client can log into the mobile app on a real phone.

Troubleshooting#

Related guides#

• cPanel deployment walkthrough
• Domain, subdomain & SSL
• Backups & restore
• Updates & rollback
• Daily checks