# Pre-Deployment Security Checklist

## Before Uploading to cPanel

### 1. File Structure & Permissions
- [ ] Verify all `api/*.php` files are present
- [ ] `config/database.php` contains database credentials (NOT in version control)
- [ ] `config/security.php` is in place
- [ ] Set directory permissions to 755, file permissions to 644
- [ ] Do NOT make `config/` directory publicly accessible

### 2. Database Configuration
- [ ] Create MySQL database in cPanel
- [ ] Create MySQL user with password
- [ ] Grant ALL privileges to the user on the database
- [ ] Update `config/database.php`:
  ```php
  $DB_HOST = 'localhost';
  $DB_NAME = 'your_database_name';
  $DB_USER = 'your_username';
  $DB_PASS = 'your_password';
  ```

### 3. Database Schema
- [ ] Copy `database_setup.sql` to your local machine
- [ ] Open cPanel → phpMyAdmin
- [ ] Select your database
- [ ] Go to SQL tab
- [ ] Paste and execute `database_setup.sql`
- [ ] Verify all tables are created

### 4. SSL/HTTPS Setup
- [ ] Enable AutoSSL in cPanel (or purchase SSL certificate)
- [ ] Force HTTPS redirect in `.htaccess`:
  ```apache
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  ```
- [ ] Verify site loads with green lock icon

### 5. File Upload to cPanel
- [ ] Upload all files to `public_html` or subdomain folder
- [ ] Keep folder structure intact:
  ```
  public_html/
  ├── index.html
  ├── HSE_management.html.html
  ├── api/
  ├── config/
  └── pictures/
  ```
- [ ] Do NOT upload `.git`, `.env`, or credentials file

### 6. Test Form Submission
- [ ] Open the site in browser
- [ ] Test login with a valid username/password
- [ ] Add a personnel record → check phpMyAdmin that it saved
- [ ] Add PPE inventory → verify fields are sanitized
- [ ] Verify no JavaScript errors in browser console

### 7. Test Logout
- [ ] Click logout button
- [ ] Open browser DevTools → Application → LocalStorage
- [ ] Verify all draft keys are DELETED
- [ ] Try to view localStorage in another tab → should be empty

### 8. Security Verification
- [ ] Try entering `<script>alert('xss')</script>` in a form field
- [ ] Submit the form
- [ ] Check database via phpMyAdmin → field should contain escaped HTML, not execute
- [ ] Verify data is readable but safe

### 9. Monitoring & Logs
- [ ] Enable error logging in cPanel
- [ ] Set `display_errors = Off` in PHP settings (errors to log, not browser)
- [ ] Check error logs for any warnings after first use

### 10. Backup Plan
- [ ] Create full backup of files and database
- [ ] Store backup outside cPanel (download locally)
- [ ] Document database credentials securely
- [ ] Create recovery plan in case of issues

---

## After Deployment - Ongoing Security

### Weekly
- [ ] Review cPanel error logs for suspicious activity
- [ ] Verify HTTPS is still active
- [ ] Test user login

### Monthly
- [ ] Backup database
- [ ] Check for PHP updates available on cPanel
- [ ] Review user accounts for unused/inactive users

### Every 3 Months
- [ ] Update SSL certificate if needed
- [ ] Audit database for suspicious data entries
- [ ] Review access logs for unusual patterns

---

## Troubleshooting

### Error: "Database connection failed"
- [ ] Check credentials in `config/database.php`
- [ ] Verify database exists in cPanel → MySQL Databases
- [ ] Verify user is assigned to database
- [ ] Test connection via phpMyAdmin

### Error: "Table 'database.table_name' doesn't exist"
- [ ] Run `database_setup.sql` in phpMyAdmin SQL tab
- [ ] Verify you selected the correct database before running SQL

### Site shows blank/white page
- [ ] Check cPanel error logs
- [ ] Verify PHP version is 5.5+ (should support `password_hash()`)
- [ ] Ensure `config/` folder permissions are 755
- [ ] Test file upload permissions

### Login fails but no error
- [ ] Verify `users` table has at least one user
- [ ] Check phpMyAdmin → `users` table → verify row exists
- [ ] Ensure password is hashed (not plaintext)

### Data not saving in forms
- [ ] Open browser DevTools → Network tab
- [ ] Submit form → check response
- [ ] Look for PHP errors in Response tab
- [ ] Verify `api/` folder exists and PHP files are readable

---

## Security Contacts

If you experience security issues:

1. **cPanel Support** → contact your hosting provider
2. **PHP Issues** → check cPanel PHP version and extensions
3. **Database Issues** → verify MySQL user privileges in cPanel

---

## Final Notes

✅ **You are good to deploy if:**
- All tests pass
- Data saves correctly
- HTTPS is active
- No errors in logs

❌ **DO NOT deploy if:**
- Login fails
- Forms don't save data
- HTTPS shows warnings
- PHP version < 5.5

Once deployed, monitor closely for the first week. If issues arise, refer back to this checklist and troubleshooting section.
