# Production deployment checklist

- [ ] Subdomain points to the extracted application directory
- [ ] PHP 8.1+ selected
- [ ] MySQL database/user created with least necessary access
- [ ] `config.php` created and database connection verified
- [ ] `base_url` is exactly `https://tracker.onetapgo.my`
- [ ] Random `ip_hash_salt` configured
- [ ] TLS/HTTPS active and forced
- [ ] `uploads/` writable and script execution blocked
- [ ] Installer completed and `install.php` deleted
- [ ] Admin password stored securely
- [ ] Staff and client access tested using separate accounts
- [ ] Client A cannot view Client B projects or reports
- [ ] Test tracking link records a click and redirects correctly
- [ ] Custom slug collision shows an error
- [ ] QR image scans to the tracking URL
- [ ] Screenshot and PDF upload tested
- [ ] Report saved as PDF and checked visually
- [ ] Daily database and file backups enabled
- [ ] Privacy notice updated for click analytics
