Mastering Django: Core

Environment-specific settings

ALLOWED_HOSTS

When DEBUG = False, Django doesn't work at all without a suitable value for ALLOWED_HOSTS. This setting is required to protect your site against some CSRF attacks. If you use a wildcard, you must perform your own validation of the Host HTTP header, or otherwise ensure that you aren't vulnerable to this category of attack.

CACHES

If you're using a cache, connection parameters may be different in development and in production. Cache servers often have weak authentication. Make sure they only accept connections from your application servers. If you're using Memcached, consider using cached sessions to improve performance.

DATABASES

Database connection parameters are probably different in development and in production. ...