Django Cheat Sheet

Install & Create Project

Project Layout

settings.py Key Settings

Django Request/Response Cycle

All Essential Commands 🔥

Model Definition 🔥

Field Types Reference

Field Options & on_delete

Custom Model Methods & Managers

QuerySet Methods 🔥

get_object_or_404 & Shortcuts

Raw SQL & Transactions

Migration Workflow

Data Migration (RunPython)

Function-Based Views (FBV)

Class-Based Views (CBV) 🔥

CBV Hierarchy & Mixins

URL Patterns 🔥

DTL Syntax Reference 🔥

Custom Template Tags

Form & ModelForm

Form in Views & Templates

Common Form Fields & Widgets

DRF Complete Pattern 🔥

DRF Settings & JWT Auth

Serializer Field Types

Custom User Model (do this first!) 🔥

Auth Views & Decorators

Permissions & Groups

ModelAdmin Full Reference 🔥

Custom Middleware

Django Signals 🔥

Built-in Signals

Cache Configuration

View & Template Caching

TestCase Full Pattern 🔥

DRF API Testing

pytest-django + Factory Boy

Essential Imports Cheat Sheet 🔥

Useful Packages Reference

Django Gotchas ⭐

Custom User Model first — set AUTH_USER_MODEL BEFORE your first migration. Changing it later is very painful.
get_user_model() not User — always use get_user_model() to reference the user model in other apps.
N+1 queries — always use select_related() for FKs and prefetch_related() for M2M/reverse FKs.
QuerySets are lazy — they hit the DB only when evaluated (iteration, slicing, len(), list(), bool()).
auto_now vs auto_now_add — auto_now updates on every save; auto_now_add only on create. Both make the field non-editable.
null vs blank — null=True for DB; blank=True for form validation. Text fields: use blank=True only, not null=True.
Signals and AppConfig.ready() — always import signals in AppConfig.ready() or they won't be registered.
admin.register vs site.register — prefer @admin.register(Model) decorator over admin.site.register(Model, Admin).
reverse_lazy vs reverse — use reverse_lazy for class attributes (success_url in CBVs); reverse() for runtime calls.
CSRF on AJAX — include X-CSRFToken header; get token from cookie or {% csrf_token %} template tag.
Static files in prod — run collectstatic; use WhiteNoise or nginx to serve /staticfiles/.
DEBUG=True in prod — exposes full traceback and settings to the world. Never!

Security Checklist ⭐

Run <code>python manage.py check --deploy</code> — catches common security issues
Set ALLOWED_HOSTS to specific domains — never <code>['*']</code> in production
Use django.middleware.security.SecurityMiddleware for HTTPS, HSTS
Set SECURE_SSL_REDIRECT=True and SESSION_COOKIE_SECURE=True
Use {% csrf_token %} in all POST forms — Django checks automatically
Always use ORM / F() expressions — never string-format raw SQL with user input
Use FileField with allowed extensions + finfo MIME check for uploads
Store secrets in environment variables — never commit .env to git
Use Content-Security-Policy headers (django-csp package)
Enable SECURE_BROWSER_XSS_FILTER and X_FRAME_OPTIONS='DENY'