Security

Authenticate users: allow only the authenticated users to access selected data. Use the @login_required decorator to enforce authentication. ▼
```
from django.contrib.auth.decorators import login_required

@login_required
def species_add(request):
```

Data ownership: check if the request.user is the data owner: ▼

from django.contrib import messages
from django.shortcuts import redirect

if species_to_update.species_owner != request.user:
    messages.warning(request, "This data belongs to a different user.")
    return redirect('account_logout')

Keep Python, Django and all 3rd party modules up-to-date: view the section on how to do updates in a safe way ▼
- To display outdated modules using pip, you can use the following command: pip list --outdated
- To display the current version of Python use: python --version
settings.py: Update the settings.py file and add the folliwing ▼
- replace SECRET_KEY with your own key
- define ALLOWED_HOSTS
- set DEBUG = False
- always use CSRF protection
- move all sensitive data to a separate .env file using python-decouple
Admin Panel: change the default ADMIN URL to a different name to reduce the risk of brute force attacks.
Backup: regularly backup the database using the django-admin dumpdata command ▼
Backup the entire database:
```
python manage.py dumpdata > backup.json
```
Backup only a selected model:
```
python manage.py dumpdata app_fossils.DBSpecies > backup.json
```
Allow users to export their data: even if re-importing isn't allowed this will enable users to retain their data.
Two-factor uthentication: consider installing and setting up the allauth allauth_2fa package to enable two-step verification.
Failed Login Monitoring: consider dding django-axes to your project to monitor failed login attempts. You can configure it to block IP addresses that exceed a certain number of failed attempts. ▼
```
pip install django-axes
```
settings.py
```
INSTALLED_APPS = [
    ...
    'axes',
]
```
```
AUTHENTICATION_BACKENDS = [
    'axes.backends.AxesStandaloneBackend',
    ...
]
```
```
MIDDLEWARE = [
    ...
    'axes.middleware.AxesMiddleware',
]
```
run migrations
```
python manage.py migrate
```
You can reset all locked accounts with the following command:
```
python manage.py axes_reset
```
To increase the limit of failed logins before IP is locked (default 3) add this line to settings.py:
```
AXES_FAILURE_LIMIT = 10
```
HTTPS and SSL: Apply for an SSL certificate and set up HTTPS to encrypt all communication between the web server and users.
Git: Create and use a .gitignore file to exclude any unnecessary files from being committed. Regularly commit your code to backup your project. Ensure all the sensitive data like the SECRET_KEY, database, etc has been excluded before the first commit!