# Step 16 Security / SEO / Performance Verification Checklist

## Deployment safety
- [ ] Work only on the new ResellBD project and its new database.
- [ ] Backup files and database before deployment; retain rollback copy.
- [ ] `.env`, database credentials, logs, backups and SQL files are not web-accessible.
- [ ] `display_errors=Off` on production; errors logged privately.
- [ ] HTTPS works and HTTP redirects to HTTPS at hosting level.

## Authentication and authorization
- [ ] Unauthenticated requests to customer-private pages redirect to login.
- [ ] Customer cannot access admin, seller or another user's records by changing IDs.
- [ ] Admin endpoints enforce roles server-side, not only by hiding links.
- [ ] Login/logout and role changes rotate/invalidate sessions as appropriate.
- [ ] Session cookie Secure is enabled when HTTPS is used; HttpOnly and SameSite are set.

## Request / data security
- [ ] Every state-changing POST validates CSRF token.
- [ ] SQL uses PDO prepared statements; no user input concatenated into SQL.
- [ ] All user-controlled HTML output is escaped.
- [ ] File uploads validate MIME, extension, size and randomized filename; executable uploads cannot run.
- [ ] Payment verification is manual and requires matching amount/reference; no secrets in source control.
- [ ] Order, stock, payment and refund changes use transactions and handle duplicate requests.
- [ ] Rate limits apply to login, search suggestions and sensitive actions.

## Product / checkout / order tests
- [ ] Out-of-stock and quantity-over-stock purchases are rejected server-side.
- [ ] Price is re-read from database at checkout; client-submitted price is ignored.
- [ ] Repeated checkout submission does not create duplicate orders.
- [ ] Cancel/return/refund stock adjustments happen exactly once.
- [ ] Customer can only see their own orders, notifications, tickets and reviews.
- [ ] Manual payment cannot be marked paid without authorized admin verification.
- [ ] Courier/COD collected amount and status history are auditable.

## SEO / browser headers / performance
- [ ] Public product/category pages have unique title, canonical URL and useful meta description.
- [ ] Sitemap lists only public canonical URLs; private/admin pages are excluded.
- [ ] `robots.txt` does not expose private data; remember robots.txt is not access control.
- [ ] Inspect response headers for X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.
- [ ] Verify mobile layout, 48px touch targets, image dimensions/lazy loading and no mixed content.
- [ ] Check database indexes and slow queries with realistic catalog/order volume.
- [ ] Run staging smoke tests on current supported PHP version and target MySQL/MariaDB.

## Record results
Date: __________  Tester: __________  Environment: __________
Failed checks / evidence: ______________________________________
Rollback decision: ____________________________________________