After installing: the checklist

Ten minutes after installing that save a bad week later.

• Sign in at /control/signin.php and confirm the dashboard reports the version you installed.
• Open the homepage, the knowledgebase and a menu page, in light and dark mode.
• Confirm /PACKAGE-MANIFEST.sha256 and /storage/ answer 403. If either opens, the shipped .htaccess is missing or not honored.
• Delete the whole install/ folder. Renaming it is not enough.
• Add the scheduler cron job, using the same PHP version as the website.
• Set the System URL to the final HTTPS address.
• Replace placeholder company, email, department and invoice details, and make the example legal pages true of your organization.
• Configure outgoing email and send a test to an outside address.
• Switch on two-factor sign-in for administrators.
• Back up the files, settings.php, the encryption hash and the database, and keep the original package outside the web root.