Next.js Production Deployment Checklist

Every deployment starts with environment hygiene. Confirm production env vars exist in the hosting provider (never in the repo), staging mirrors production keys with test credentials, and preview deployments cannot reach production databases. Rotate any secret that ever appeared in logs, chat, or screenshots.

Verify build-time vs runtime variables: Next.js inlines NEXT_PUBLIC_ vars at build time, so a promote-to-production flow must rebuild. Document which vars require rebuilds in your runbook so on-call engineers never guess.

Confirm sitemap.xml lists every indexable route, robots.txt allows them, and canonicals are self-referencing. Run Lighthouse on the three highest-traffic templates — LCP under 2.5s, CLS at zero — and verify OG images render in validators.

Set Cache-Control deliberately: immutable for hashed assets, short TTL with stale-while-revalidate for HTML, and no-store for personalised responses. Purge CDN caches as a deployment step, not an afterthought.

Security headers (HSTS, CSP, X-Frame-Options) must be present in production responses — test with a header scan, not by reading config. Confirm auth cookies are HttpOnly, SameSite, and Secure, and rate limits guard login and payment endpoints.

Every deploy needs a one-command rollback: tagged releases, database migrations that are backwards-compatible, and a verified restore from the latest backup within the last 30 days. If you cannot roll back in five minutes, you are not ready to ship.