Django E-Commerce Security Setup

I have already ported my product catalogue and templates over to Django; now I need the critical security layer that makes the site production-ready. Customers must be able to sign up, log in, reset passwords, view their order history and status, and save addresses and payment details—all over HTTPS and protected by best-practice authentication and encryption.

We are not processing cards online yet; payments will be completed by bank transfer or pay on delivery, so no card data needs to be stored. The site will store only account credentials and order history, and those records must be encrypted at rest and safeguarded in transit.

What I still need:

• Robust Django auth configuration (custom user model if required), salted password hashing, and MFA hooks ready for later rollout.
• Environment-specific secret key handling, rotated via env vars or a secrets manager.
• CSRF, session, and cookie settings tightened for production.
• Field-level encryption or database-level encryption for personal data (name, email, phone, addresses).
• Secure email backend for password resets and order updates, with credentials pulled from environment.
• Clear documentation on how to add additional secure views or forms in the future.

I will provide repository access and a staging server running Django 4.x, Postgres, and Nginx. Success is a merge-ready branch that passes Django’s security checks, lets me deploy to staging with all tests green, and gives customers a seamless, protected account area.