Deployment and a security checklist

Deployment is moving the shop from the developer's computer to the server where customers will use it. For OpenCart it is copying the files and the database and correcting two configuration files. After that the shop is closed from typical attacks — the list is short, but each item matters.

What is moved

What	How
Files	The whole site folder, including `image/` and `extension/`
Database	A dump: export on the old server, import on the new one
Storage	The `storage` folder, if it was moved out of `system/`

The dump is made in phpMyAdmin or from the console:

mysqldump -u root -p shop > shop.sql
mysql -u shop_user -p shop_production < shop.sql

The first command saves the database to a file, the second loads it on the new server.

Configuration files

Paths and addresses are written in config.php and admin/config.php as absolute values. On the new server correct them in both files:

// config.php
define('HTTP_SERVER', 'https://shop.example.com/');
 
define('DIR_OPENCART', '/var/www/shop/');
define('DIR_STORAGE', '/var/www/storage/');
 
define('DB_HOSTNAME', 'localhost');
define('DB_USERNAME', 'shop_user');
define('DB_PASSWORD', 'secret');
define('DB_DATABASE', 'shop_production');

In admin/config.php there are two addresses: HTTP_SERVER with the admin folder and HTTP_CATALOG with the storefront address. Open https://shop.example.com/ — the storefront works; the admin panel opens at the address of its folder.

The exact set of constants differs slightly between releases — change the values, do not copy the file from another version.

Checklist before launch

Check	Why
The `install` folder is deleted	Otherwise the shop can be reinstalled by anyone
The `storage` folder is outside the site root	It holds logs, sessions and uploads
The `admin` folder is renamed	The address `/admin` is scanned by bots
Error display is off, the error log is on	Errors are not shown to customers
HTTPS is on, addresses in both configs start with `https`	Protection of logins and customer data
`config.php` files are read-only	They hold the database password
The administrator password is long and unique	It is the first thing attackers try
Backups of files and database run on a schedule	To recover after a failure
The line for `cron/cron` is in the system crontab	Scheduled jobs run

The admin panel itself offers to move storage and rename admin on the first login — a window with these two steps appears on the dashboard. Error display is switched in System → Settings, the Server tab.

After the move

Delete the files in the cache folder of the storage, open the storefront and the admin panel, place a test order and check that the letter about it arrives.

Common mistake

After the move the storefront opens, but pictures and styles are loaded from the old address, or the admin panel shows a blank page. Only config.php was corrected and admin/config.php was forgotten, or one of the DIR_ paths points to a folder that does not exist on the new server. Check every line of both files.

Thanks for reading!