Django Cheat Sheet 2026

The 30 highest-yield Django facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does Django's `ALLOWED_HOSTS` setting prevent? → HTTP Host header injection attacks by whitelisting valid hostnames for the site
2. What is Django REST Framework (DRF)? → A powerful toolkit for building Web APIs on top of Django
3. What does `form.as_p()` do in Django? → Renders the form fields wrapped in HTML tags
4. Which template tag is used to extend a base template in Django? → {% extends 'base.html' %}
5. What is the purpose of Django's `RequestFactory`? → Creating request instances to pass directly to view functions without middleware
6. What does prefetch_related() optimize compared to select_related()? → Many-to-many and reverse foreign key relations
7. What does Django's F() expression let you do? → Reference a model field's value in a database query
8. Which decorator restricts a view to logged-in users in Django? → @login_required
9. What does marking a variable with `{{ value|safe }}` do in Django templates? → Disables auto-escaping for that variable, rendering raw HTML
10. What does `{{ forloop.counter }}` provide inside a Django for loop? → The 1-based index of the current loop iteration
11. Which command creates an administrative superuser account? → python manage.py createsuperuser
12. When DEBUG is set to _______________ in settings.py, Django will email unhandled exceptional conditions. → False
13. What is the purpose of Django's `AUTH_PASSWORD_VALIDATORS` setting? → Defines rules like minimum length and common password checks enforced on password changes
14. Which Django command applies pending database migrations to the database? → python manage.py migrate
15. There are _____________ components to the MVC pattern. → three
16. What does Django's atomic() context manager guarantee for a block of database operations? → All succeed together or none are committed
17. Which field option sets the default value for a Django model field? → default=
18. Which middleware setting position matters because middleware runs in order for requests? → Top entries process requests first
19. What is DRF's `Router` used for? → Automatically generating URL patterns for ViewSet actions
20. What does `login(request, user)` do in Django? → Attaches the user to the session and marks them as logged in
21. What is a Django formset? → A collection of forms that allows processing multiple form instances at once
22. What does the `X-Frame-Options: DENY` header configured via Django's `XFrameOptionsMiddleware` prevent? → Clickjacking attacks where the site is embedded in an iframe
23. What function reverses a URL pattern by name in Django? → reverse()
24. How does DRF's `ModelSerializer` handle the `create()` method by default? → It calls Model.objects.create() with the validated data
25. Which decorator restricts a view to logged-in users only? → @login_required
26. Which Django generic CBV is used to display a list of objects? → ListView
27. How do you define a URL namespace in Django to avoid name collisions between apps? → Set app_name in the app's urls.py or use namespace= in include()
28. What does the `as_view()` method do on a Django class-based view? → Converts the CBV class into a callable that Django's URL router can use
29. Which Django template tag is used for conditional rendering? → {% if condition %}...{% endif %}
30. What is Django's default caching mechanism? → simple