Pilots with ten thousand flight hours still read a printed checklist before takeoff — not because they forgot how to fly, but because memory is exactly the thing that fails when you are tired, rushed, or fixing something small. Self-hosted n8n production failures share that shape: rarely caused by what you never learned, almost always caused by the one step you were certain you did. Five rules, each verifiable in about sixty seconds.
Rule 1 — Never deploy an un-audited export
The exported workflow JSON is the only artifact that travels from editor to production. Localhost URLs, broken node references, embedded secrets — all visible in the file, all invisible in the editor. Skip the audit once and you haven't saved a minute; you bought a lottery ticket.
Rule 2 — Every webhook is a public door until it is not
A Webhook node with no auth header, signature check, or HMAC secret can be run by anyone with the URL — and endpoint scanners find things by construction, not luck. No workflow ships with an unauthenticated inbound webhook unless the payload is provably harmless.
Rule 3 — Retries are the difference between noise and loss
External APIs throttle. DNS hiccups. Containers restart mid-request. Without Retry On Fail configured per node (max tries, wait interval), each one silently deletes a client deliverable. n8n does not retry by default.
Rule 4 — Separate secrets from structure
Credentials live in n8n's credential store, never in node parameters or code nodes. The exported JSON carries structural references, not usable keys — because that file will travel: to Git, to a client handoff, to a support paste. Leaked exports poison your backup and recovery story too.
Rule 5 — Monitor runs, validate exports
Execution failures should arrive as notifications, not as angry client messages three days later. Combined with Rule 1, you get the complete defense: preflight kills failures before birth, monitoring catches the rare survivor.
The whole checklist in sixty seconds
Export the workflow → paste into the free n8n workflow audit → read five plain-language verdicts. Runs entirely in your browser tab; nothing uploads, no account.
Honesty first: the free page enforces five rules. The 24-rule preflight, 21 documented fixes, and client-ready PDF report live in the full Reliability Kit ($39 $19 launch, disclosing: mine).
Checklists are not for the forgetful — they are for professionals who know what a forgotten sixty seconds costs at 2 a.m.
Top comments (0)