Three steps catch almost every launch-day problem: run the installation doctor, wipe your test orders, and make sure your database file cannot be downloaded.
Run the installation doctor
bin/plugin kahunacart check
It checks the database, migrations, the scheduler, mail, the worker environment, download folders, trusted proxies, the site address, provider credentials, webhook reachability, template drift and the report rollup, and prints a fix for each one that is not green. The same checks are in the admin under KahunaCart → Operations → Health, with a Run checks button.
Fix every failure, and read every warning before you launch.
Wipe the test orders
bin/plugin kahunacart reset --orders --keep-settings
This deletes every order and what hangs off it, and keeps products, categories, tax, shipping, coupons, payment methods and settings. Add --customers to remove test customers too. The command prints what it will delete and asks first.
Caution
A reset cannot be undone. Take a backup first.
Check your database file is not downloadable
With SQLite, the database lives under user/. KahunaCart protects it with an .htaccess file, which only Apache reads. On nginx or Caddy, test it from outside:
curl -sI https://your-site.com/user/data/kahunacart/db/kahunacart.sqlite | head -1
Anything other than 403 or 404 means your order history is downloadable. Move the data folders outside the web root, or add a deny rule. See Hardening → Deny the data directories.
More detail
- Going live in the docs
- Hardening