Minimal production settings
Keep platform-specific values outside the repository. Read the secret key, database URL, allowed hosts and CSRF origins from environment variables. Set DEBUG=False, enforce HTTPS and run Django’s deployment checks before publishing.
WhiteNoise is a practical option for a small app’s static assets. User uploads are different: put them in object storage because the web-service filesystem may be replaced on every deploy.
Recommended build flow
Install locked dependencies, run collectstatic, apply migrations and start Gunicorn. For a serious system, migrations should be a controlled release step instead of happening concurrently on multiple instances. For a one-instance demo, the combined flow is acceptable if failures stop the deploy.
After deployment, test more than the home page. Create and read a database record, load CSS from a clean browser session, restart the service and verify the data remains. That restart test catches the most common false-success in free Django hosting.