Deploy a Node.js Backend to Production

Audit Your Backend for Production Readiness

Before deploying, identify exactly what the backend needs to run outside your local development environment. Use your AI coding assistant to inspect the backend project.

Node.js Backend Production Audit

Reports the Node.js framework, package manager, production install/build/start commands, entry point, required Node.js version, port handling, every required environment-variable name, database and auth setup, CORS and cookie configuration, and every production-domain dependency — then flags development-only assumptions that would fail in production, without exposing secret values or deploying anything.

Review this Node.js backend specifically for production deployment. Identify: - the Node.js framework or server library - the package manager - the production install command - the build command, if required - the production start command - the server entry point - the required Node.js version - how the server currently chooses its port - every environment variable required in production — names only - the database provider and connection method - authentication and session handling - CORS configuration - cookies and security-related cookie settings - API routes and public endpoints - file uploads and storage - email - payments and webhooks - AI or external APIs - scheduled/background jobs - WebSockets or realtime features - local filesystem dependencies - hard-coded localhost URLs - frontend URLs or allowed origins - callback, webhook, redirect, or return URLs - anything that depends on the final production domain Also check for development-only assumptions that would fail in production, including: - hard-coded ports - localhost database connections - development start commands - private secrets committed to source code - files that must persist but are stored only on the local filesystem Do not expose secret values. Do not change or deploy anything yet. Finish with: 1. the exact production install/build/start commands 2. the required Node.js version 3. the required production environment-variable names 4. external services that must remain connected 5. anything that must be fixed before deployment

Make Only the Changes Production Requires

Make only the changes required to run the backend reliably in production, using the audit from Step 1.

Node.js Backend Production Preparation

Fixes production package scripts, port handling, environment-variable loading, CORS and cookie configuration, trusted origins, and other deployment-blocking issues found in the audit, without exposing server secrets or rewriting the backend — then runs the production build and reports READY or NOT READY with the exact install, build, start commands, entry point, and required Node.js version.

Prepare this Node.js backend for production hosting using the audit you just completed. Make the smallest necessary changes. Check and fix where required: - production package scripts - build configuration - production start command - Node.js version compatibility - server entry point - production port handling - graceful startup and failure behavior - environment-variable loading - CORS configuration - secure cookie settings - trusted production origins - hard-coded localhost URLs - database connection configuration - production API URLs - file-upload/storage assumptions - webhook or callback URLs The application must use the hosting platform's assigned port rather than depending on a fixed local development port. Keep private credentials server-side. Do not expose database passwords, service-account credentials, private API keys, payment secrets, or other server secrets to frontend code. Preserve the existing backend architecture and working external services. Do not rewrite the backend or change frameworks unless absolutely necessary. Run the production build or equivalent validation and fix deployment-related errors. Do not deploy anything yet. Finish with: Production preparation: READY / NOT READY If READY, give me: - install command - build command, if required - start command - server entry point - required Node.js version If NOT READY, list exactly what remains.

Set Up the Production Database

Before deploying the server, prepare the services it will need in production.

Make sure the backend connects to the correct production database rather than a local development database. If database migrations are required, identify them before launching the backend.

IMPORTANT

Do not delete, reset, or overwrite production data automatically.

Prepare the Production Environment Variables

Prepare the required production values identified in Step 1.

Database connection URL

Authentication secrets

JWT/session secrets

Allowed frontend origin

Email provider credentials

Payment credentials

Webhook secrets

Storage credentials

External API keys

AI API keys

IMPORTANT

Never store these values directly in the repository.

Check the Production Configuration

Review this backend's production configuration before adding it to Hostinger.

Production Configuration Review

Verifies every required environment-variable name, database, authentication/session, CORS, cookie, storage, email, payment/webhook, and external API configuration, and any required migrations, then separates variables into what's needed to start, what's feature-specific, and what depends on the final domain — without revealing secret values — and returns READY or NOT READY.

Review this backend's production configuration before I add it to Hostinger. Verify: - every required environment-variable name - database configuration - authentication/session configuration - production CORS origins - cookie settings - storage configuration - email configuration - payment and webhook configuration - external API configuration - any required database migrations - production-domain dependencies Separate the variables into: 1. required immediately for the backend to start 2. required only for specific features 3. values that depend on the final production domain Do not reveal or request secret values. Check that no server secret is accidentally exposed to frontend code. Do not deploy or modify production data. Finish with: Production configuration: READY / NOT READY

Get Hostinger Node.js Hosting

This tutorial uses Hostinger to run the production backend.

Get Hostinger Node.js Hosting

Deploy your Node.js backend from GitHub with production environment variables.

USED IN THIS TUTORIAL

https://www.hostg.xyz/SHJyP

Push the Production-Ready Backend to GitHub

Push the production-ready backend to GitHub if it is not already there.

The repository includes the files needed to rebuild the backend

No .env files or private credentials are included

Create the Node.js Application

In Hostinger, create a new Node.js application and connect the backend repository.

Websites Add Website Deploy Web App

Connect the backend repository Set the production branch Set the Node.js version, install command, build command if required, start command, and entry point Add the production environment variables Start the deployment and review the build/runtime logs

Test the Temporary Deployment

Before connecting the final domain or frontend, verify that the backend itself is running.

Health/status endpoint, if available

Public API endpoints

Authenticated endpoints

Database reads

Database writes

File uploads

Email

External API calls

Deployed Backend Review

Checks the deployment/runtime logs and configuration for startup failures, missing environment variables, database connectivity, authentication/session and CORS errors, route failures, storage or external API failures, and runtime exceptions — diagnoses the root cause of any error you provide without weakening security — and returns PASS or NOT READY with exactly what must be fixed.

Review this deployed Node.js backend before I connect it to the live frontend. Use the deployment/runtime logs and project configuration to check: - whether the server starts successfully - whether it is listening correctly in production - missing environment variables - database connectivity - authentication/session errors - CORS errors - API route failures - file/storage errors - external API failures - payment or webhook configuration - runtime exceptions If I provide an error or log, identify the root cause and make only the smallest necessary fix. Do not weaken authentication or security just to make a request succeed. Do not deploy automatically. Finish with: Backend deployment: PASS / NOT READY If NOT READY, list exactly what must be fixed.

IMPORTANT

Do not connect production traffic until the backend passes the important tests.

Connect the Domain and Update Production Origins

Once the backend works independently, connect it to the real application.

A common setup is api.example.com for the backend and example.com for the frontend. Configure the backend domain or subdomain and HTTPS, then update the frontend so its production API base URL points to the new backend.

Update anything that depends on the final URLs:

Frontend API base URL

Backend allowed origin

CORS

Authentication callbacks

Cookies

OAuth redirects

Payment return URLs

Webhooks

Email links

External service callbacks

If the frontend or backend uses environment variables for these URLs, update them and redeploy the affected application.

Run the Final Production Test

Test the application through the real frontend rather than testing only API endpoints directly.

Frontend → backend requests

Signup/login

Protected endpoints

Sessions/cookies

Database reads and writes

CORS

File uploads

Email

Payments

Webhooks

External APIs

Mobile/browser behavior

HTTPS

Final Production-Readiness Audit

Runs a full production-readiness audit across HTTPS, the production API domain, CORS, authentication, sessions, cookies, protected routes, database access, storage, email, payments/webhooks, and external APIs — confirms nothing depends on localhost or exposes private credentials to the frontend — without weakening security to pass a test — and returns GO or NO-GO with exactly what must be fixed.

Run a final production-readiness audit for this Node.js backend now that it is connected to the live frontend and production domain. Verify: - the backend starts and remains available - HTTPS works - the production API domain works - the frontend is using the correct production API URL - CORS allows only the required production origins - authentication works - sessions or tokens work correctly - secure cookies work correctly if used - protected API routes remain protected - database reads and writes work - private user data remains protected - storage/uploads work - email works - payments and webhooks work if used - external APIs work - no production code depends on localhost - no private server credentials are exposed to the frontend - no important runtime errors remain Do not weaken security controls to make a failing test pass. Do not expose secrets. Finish with: Production status: GO / NO-GO If NO-GO, list exactly what must be fixed before real users should depend on this backend.

For future backend updates:

Make your changes Test locally Check for new environment variables Check whether database migrations are required Run the production build/tests Push the changes to GitHub Let Hostinger redeploy the backend Test the affected production endpoints and frontend flows

Check Before You Publish an Update

Pre-Update Safety Check

Reviews the changes, runs the production build/tests, and checks for new environment variables, required database migrations, authentication/session impact, frontend API compatibility, storage/email/payment/webhook/external-API impact, and CORS or production-URL changes — without deploying automatically — then returns YES or NO on whether the update is ready to publish.

I have updated this production Node.js backend. Before I publish the update: - review the changes - run the production build/tests - check for new or changed environment variables - check whether database migrations are required - check authentication and session impact - check API compatibility with the frontend - check storage, email, payment, webhook, or external API impact - check whether CORS or production URLs changed Do not deploy automatically. Finish with: Ready to update: YES / NO If NO, tell me what must be completed first.