7 Django settings I change on every new project

django-admin startproject gives you a settings file that works on your laptop and nowhere else. These are the changes I make on day one, before the first model.

1. A custom user model, before the first migration

Changing the user model later is painful. Doing it now costs two minutes, even if it's empty.

# accounts/models.py
from django.contrib.auth.models import AbstractUser

class User(AbstractUser):
    pass

# settings.py
AUTH_USER_MODEL = "accounts.User"

2. Secrets and debug from the environment

Never commit SECRET_KEY, and never let DEBUG=True reach production by accident.

import os

SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
DEBUG = os.environ.get("DJANGO_DEBUG", "false").lower() == "true"

3. ALLOWED_HOSTS from the environment

ALLOWED_HOSTS = os.environ.get("DJANGO_ALLOWED_HOSTS", "localhost").split(",")

4. The database from one URL

With dj-database-url, one variable configures the whole database, and it matches what most hosts give you.

import dj_database_url

DATABASES = {"default": dj_database_url.config(default="sqlite:///db.sqlite3")}

5. Your time zone, with USE_TZ on

Store everything in UTC and show it in local time. For products in India:

TIME_ZONE = "Asia/Kolkata"
USE_TZ = True

6. Static files that work in production

WhiteNoise lets Django serve its own static files efficiently, so you don't need a separate setup for CSS and the admin.

STATIC_URL = "static/"
STATIC_ROOT = BASE_DIR / "staticfiles"

MIDDLEWARE.insert(1, "whitenoise.middleware.WhiteNoiseMiddleware")

7. Settings for running behind a proxy

If Nginx, Caddy or your host handles HTTPS, Django needs to know, or forms and redirects break in confusing ways.

SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
CSRF_TRUSTED_ORIGINS = ["https://yourdomain.com"]

if not DEBUG:
    SESSION_COOKIE_SECURE = True
    CSRF_COOKIE_SECURE = True

Then check it

Django ships with a checker for exactly this. Run it before every first deploy:

python manage.py check --deploy