Level 6 · In practice

6.4Checklists & templates

Goal: turn technical mastery of PHP into reliable, safe and maintainable production habits.

Estimated time: 14 min · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

At kick-off: environment aligned with prod, Composer + .gitignore, MVC/PSR-4, modelled database, strict_types and ===.
Before production: prepared + htmlspecialchars + CSRF, secrets in .env, logged errors, PHPUnit + CI/CD, backups.
Rule: a checklist ticked every time beats a method known by heart — under rush, you execute.

Riad thread — the sheets at hand

After one year, both sheets below are posted at Riad's desk: the kick-off one next to the screen, the go-live one in his drawer with the contact's details. “What saved me, he says in substance, is not knowing the items, it is ticking them every time — especially in rush weeks.”

Adapt the wording to your context, keep the structure: it is what prevents omissions and incidents.

Two lists to keep at hand

One checklist when starting a PHP project, one before going live. They turn good reflexes into a verifiable routine.

Starting a PHP project

Local environment ready (AMP pack or Docker), PHP version aligned with production.
Composer initialised; .gitignore (vendor/, .env); secrets out of the repo.
Structure decided (logical files or MVC / framework), consistent namespaces (PSR-4).
Database modelled (tables, relations); access via PDO (exception mode) or an ORM.
Reflexes active: declare(strict_types=1), === by default, never trust inputs.

Before going live

Security: prepared statements (SQL), htmlspecialchars (display), CSRF, hashed passwords, authorisation.
Secrets and config via environment variables (never in code or Git); HTTPS enabled.
Errors NOT displayed (logged); OPcache enabled; Composer autoloader optimised.
Tests (PHPUnit) green; CI/CD pipeline testing before deploying; deployment via Git.
Migrations run, separate environments (dev/staging/prod), backups in place.

Common misinterpretation: “collecting checklists”. No. A checklist is only useful ticked and used: take the one for your next project, the others will wait.

Text version of the diagram (SEO / screen readers / translation): Two moments, two sheets: 1) At kick-off — aligned environment, Composer + .gitignore, MVC/PSR-4, modelled database, strict_types and ===. 2) Before production — prepared + htmlspecialchars + CSRF + hash, .env + HTTPS, logged errors + OPcache, PHPUnit + CI/CD, migrations and backups. Lesson: no more thinking under pressure, you run the sheet.

Ready-to-say script — validating a go-live (30 s)

“Prepared, htmlspecialchars, CSRF, hash, authorisation? Secrets in .env out of Git, HTTPS? Errors logged, OPcache, optimised autoload? PHPUnit green and CI/CD? Migrations, separate environments, backups? If any no, we do not go live.”

Copy-paste template — kick-off + production tracking (1 line per item)


      
        VSE / small budget
Sheets on one wall-posted page: the essentials (versions, prepared, .env, tests) are enough.
        SME Constantine
Plan local realities into the sheet: known contacts, peaks, travel, verified backups.
        Remote / hybrid
Add a written-confirmation line to tracking: at a distance, a dated, validated go-live avoids misunderstandings.
        Intercultural
Spell out labels in writing: what seems obvious (who validates, which environment) is not obvious to everyone.
      
      Caution: General reminder: secrets, passwords and environments engage your organisation — environment variables out of Git, limited access and validation by the designated contact; this guide gives no legal advice.
      
      48h challenge — apply tomorrow
Take 1 real project, run the “at kick-off” checklist and tick where it stands. Note the contact on the production sheet.
      Section exit checklistI ticked a checklist on a real project.
I can pull out kick-off and pre-production at the right time.
I did the 48h challenge or scheduled its date.
        Self-assessment 1-5: tooling of my projects?dated use of checklists?
      
      ← Previous : Best practices & pitfalls (V3)Next : Going further (V3) →
      
      
 Check your understanding
Riad is about to put his PHP application live. What must he tick first?






 Pre-production holds with: prepared + htmlspecialchars + CSRF + hash + authorisation, .env out of Git + HTTPS, logged errors + OPcache, green PHPUnit + CI/CD, migrations and backups.

      
      
      💡Tip: these checklists prevent most incidents — security flaw, leaked secret, errors exposed in production, undetected regression, failed deployment.