To-do

ensure appropriate caching headers are used
remove jQuery
consider removing events and worldmap modules
ask Denver about why so many license files
serve a 400 in Apache for a hostname we don't explicitly support
use <detail> elements for supporter page hidden sections, rather than complex jQuery - or consider Alpine.js
replace internalNavigate with inline flexbox layout
add tests for main pages returning 200
move sponsors.py and sponsors.html into supporters app

Done

split the template/content files out from conservancy/static into their own content directory (avoid mixing static and non-static content)
remove ForceCanonicalHostnameMiddleware by ensuring canonical redirect and HTTPS redirect is done by Apache
standardise settings to replace settings.py and djangocommonsettings.py with settings/prod.py and move SECRET_KEY to an environment variable
migrate to Django 4.2 LTS
review apache2 directory - may be unused
add deployment script that runs migrations and collects static files
switch ParameterValidator to use SECRET_KEY if possible to minimize non-standard settings
install staticfiles app