Production security relies on DEBUG = False, a protected SECRET_KEY, explicit ALLOWED_HOSTS, HTTPS and secure cookies. Django already protects against CSRF, XSS and SQL injection, as long as these mechanisms are not bypassed. The check --deploy command flags missing settings.
Example
python manage.py check --deploy