Validate security, billing, email, automation and recovery before accepting real customers.

Identity and URLs

• Company name, logo, address and sender identity are correct.
• System URL uses the canonical HTTPS hostname and ends with /.
• The private administrator directory is not the default.
• Customer registration, login, password reset and email verification work.

Money flow

• Currency formatting, tax rules, invoice numbering and due dates match the business.
• At least one gateway completes a sandbox payment and verified callback.
• A duplicate callback does not create a duplicate transaction.
• Refund and cancellation policies match configured automation.

Operations

• The master cron invocation is recent and recurring.
• SMTP test and queued mail delivery succeed.
• Provisioning test connection and a complete create/suspend/unsuspend/terminate cycle succeed.
• File and database backups are encrypted, off-server and restore-tested.

Security

• Administrator 2FA and least-privilege roles are enabled.
• Detailed production errors are disabled.
• Installer, configuration, attachments and logs cannot execute or be downloaded.
• API credentials have exact scopes and source-IP restrictions.