DXP project checklist #

This page is for developers and project leads who run a DXP project. Copy it into your project's tracker and tick the items off.

Contents #

1. Before the project
2. Install and security
3. Content and theme
4. APIs
5. Performance and operations
6. Launch
7. After launch

Before the project #

• To do: The DXP is the right product, not Nexus, Legacy or Exponential 6 (Choosing).
• To do: Every promised feature is in the package list (Claims to avoid).
• To do: Servers run PHP 8.3 or newer; Node.js 20 is available where you build (Versions).

Install and security #

• To do: Project created from the skeleton, under Git, .env.local and JWT keys ignored (Installing).
• To do: The installer's administrator password changed; editors have their own accounts.
• To do: APP_ENV=prod, APP_DEBUG=0, HTTPS only on production (Web server setup).
• To do: Permissions set with ACLs; nothing is 777 (File permissions).
• To do: No upstream package installed beside its fork (The forks).
• To do: Test users and mail use example.invalid; development mail goes to null://null.

Content and theme #

• To do: Content types reviewed with editors and client developers (Content model).
• To do: A design with your theme before standard (The standard design and your theme).
• To do: Image variations for every size the design uses (Image variations).
• To do: Templates accessible, with no inline scripts or styles.

APIs #

• To do: REST prefix checked and kept in client configuration (The REST API).
• To do: JWT firewalls enabled only if needed; one user and role per client (JWT).
• To do: GraphQL schema generated and committed (GraphQL).
• To do: CORS limited to your origins.

Performance and operations #

• To do: HTTP cache on, purging tested (HTTP cache).
• To do: Cache pool chosen (filesystem or Redis) (Application cache).
• To do: Search engine chosen and indexed (Search).
• To do: Cron line installed for the web server user (Cron).
• To do: Message workers supervised, if you use an async transport (Messenger).
• To do: Backups of the database, public/var/, .env.local and the JWT keys, and a restore tested.

Launch #

• To do: The deploy runs in the documented order (Deploying).
• To do: Smoke tests of the site, /adminui/ and the APIs pass.
• To do: Logs are watched for the first days.

After launch #

• To do: Updates on a schedule, on a branch, with composer.lock committed (Updating).
• To do: Release notes of the forks read before each update.
• To do: Old versions pruned with exponential:content:cleanup-versions, tested first.
• To do: Bugs found reported back (Contributing).

Related pages #

• DXP Developers: start here
• Deploying
• Troubleshooting
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.