diff --git a/tests/test_bake_django.py b/tests/test_bake_django.py
index de0f7b1a..7230c177 100644
--- a/tests/test_bake_django.py
+++ b/tests/test_bake_django.py
@@ -50,6 +50,10 @@ def test_baked_django_with_allauth_settings_ok(cookies):
     assert (
         '                "django.template.context_processors.request",' in settings_file
     )
+    assert (
+        "ACCOUNT_UNIQUE_EMAIL = True                      # Default dj-allauth"
+        in settings_file
+    )
 
 
 def test_baked_django_without_allauth_settings_ok(cookies):
@@ -66,6 +70,10 @@ def test_baked_django_without_allauth_settings_ok(cookies):
     assert (
         '                "django.template.context_processors.request",' in settings_file
     )
+    assert (
+        "ACCOUNT_UNIQUE_EMAIL = True                      # Default dj-allauth"
+        not in settings_file
+    )
 
 
 def test_baked_django_with_allauth_url_ok(cookies):
@@ -779,7 +787,7 @@ def test_baked_django_without_semantic_release(cookies):
     assert "   :alt: Python Sementic Release" not in readme_file
 
 
-def test_baked_django_settings_base_file_ok(cookies):
+def test_baked_django_base_settings_base_file_ok(cookies):
     """Test Django settings.py file has generated correctly."""
     default_django = cookies.bake()
 
@@ -788,7 +796,6 @@ def test_baked_django_settings_base_file_ok(cookies):
     settings_file = settings_path.read_text().splitlines()
 
     assert '"""Django base settings for django-boilerplate project.' in settings_file
-    assert 'ALLOWED_HOSTS = ["www.example.com"]' in settings_file
     assert 'INTERNAL_IPS = ["127.0.0.1"]' in settings_file
     assert 'ROOT_URLCONF = "django_boilerplate.urls"' in settings_file
     assert 'WSGI_APPLICATION = "django_boilerplate.wsgi.application"' in settings_file
@@ -822,6 +829,7 @@ def test_baked_django_settings_production_file_ok(cookies):
         '"""Django production settings for django-boilerplate project."""'
         in settings_file
     )
+    assert 'ALLOWED_HOSTS = ["www.example.com"]' in settings_file
 
 
 def test_baked_django_settings_staging_file_ok(cookies):
@@ -834,6 +842,7 @@ def test_baked_django_settings_staging_file_ok(cookies):
     assert (
         '"""Django staging settings for django-boilerplate project."""' in settings_file
     )
+    assert 'ALLOWED_HOSTS = ["www.example.com"]' in settings_file
 
 
 def test_baked_django_settings_test_file_ok(cookies):
@@ -844,6 +853,7 @@ def test_baked_django_settings_test_file_ok(cookies):
     settings_file = settings_path.read_text().splitlines()
 
     assert '"""Django test settings for django-boilerplate project."""' in settings_file
+    assert 'ALLOWED_HOSTS = ["www.example.com"]' in settings_file
 
 
 def test_baked_django_urls_file_ok(cookies):
diff --git a/{{cookiecutter.git_project_name}}/config/requirements/base.txt b/{{cookiecutter.git_project_name}}/config/requirements/base.txt
index 8dd52fdf..df0c281a 100644
--- a/{{cookiecutter.git_project_name}}/config/requirements/base.txt
+++ b/{{cookiecutter.git_project_name}}/config/requirements/base.txt
@@ -2,3 +2,4 @@ Django==3.2.8
 {% if cookiecutter.use_django_allauth == "y" %}
 django-allauth==0.45.0
 {% endif %}
+django-environ==0.7.0
diff --git a/{{cookiecutter.git_project_name}}/config/requirements/local.txt b/{{cookiecutter.git_project_name}}/config/requirements/local.txt
index e69de29b..749b80b7 100644
--- a/{{cookiecutter.git_project_name}}/config/requirements/local.txt
+++ b/{{cookiecutter.git_project_name}}/config/requirements/local.txt
@@ -0,0 +1,6 @@
+-r base.txt
+-r test.txt
+django-debug-toolbar==3.2.2
+django-debug-toolbar-template-profiler==2.0.2
+
+pre-commit==2.15.0
diff --git a/{{cookiecutter.git_project_name}}/config/requirements/production.txt b/{{cookiecutter.git_project_name}}/config/requirements/production.txt
index e69de29b..a3e81b8d 100644
--- a/{{cookiecutter.git_project_name}}/config/requirements/production.txt
+++ b/{{cookiecutter.git_project_name}}/config/requirements/production.txt
@@ -0,0 +1 @@
+-r base.txt
diff --git a/{{cookiecutter.git_project_name}}/config/requirements/staging.txt b/{{cookiecutter.git_project_name}}/config/requirements/staging.txt
index e69de29b..a3e81b8d 100644
--- a/{{cookiecutter.git_project_name}}/config/requirements/staging.txt
+++ b/{{cookiecutter.git_project_name}}/config/requirements/staging.txt
@@ -0,0 +1 @@
+-r base.txt
diff --git a/{{cookiecutter.git_project_name}}/config/settings/base.py b/{{cookiecutter.git_project_name}}/config/settings/base.py
index 0c557f26..9f51be64 100644
--- a/{{cookiecutter.git_project_name}}/config/settings/base.py
+++ b/{{cookiecutter.git_project_name}}/config/settings/base.py
@@ -13,8 +13,14 @@
 import os
 from django.utils.translation import ugettext_lazy as _
 from .username_blacklist import data as username_blacklist
+import environ
 
 
+env = environ.Env(
+    # set casting, default value
+    DEBUG=(bool, False)
+)
+
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent.parent
 
@@ -27,9 +33,8 @@
     'DJANGO_SECRET_KEY', '!!!SET DJANGO_SECRET_KEY!!!')
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG =False
-
-ALLOWED_HOSTS = ["{{cookiecutter.ALLOWED_HOSTS}}"]
+# False if not in os.environ because of casting above
+DEBUG = env('DEBUG')
 
 INTERNAL_IPS = ["{{cookiecutter.INTERNAL_IPS}}"]
 
@@ -188,7 +193,7 @@
 
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
-
+{% if cookiecutter.use_django_allauth == "y" %}
 # Django Allauth Settings
 # https://django-allauth.readthedocs.io/en/latest/configuration.html
 ACCOUNT_AUTHENTICATION_METHOD = "username_email" # Default dj-allauth == username
@@ -200,3 +205,4 @@
 ACCOUNT_USERNAME_REQUIRED = True                 # Default dj-allauth
 ACCOUNT_USERNAME_MIN_LENGTH = 3                  # Default dj-allauth == 1
 ACCOUNT_USERNAME_BLACKLIST = username_blacklist
+{% endif %}
diff --git a/{{cookiecutter.git_project_name}}/config/settings/local.py b/{{cookiecutter.git_project_name}}/config/settings/local.py
index 2291ddb4..42c2c1f0 100644
--- a/{{cookiecutter.git_project_name}}/config/settings/local.py
+++ b/{{cookiecutter.git_project_name}}/config/settings/local.py
@@ -2,16 +2,20 @@
 
 from .base import *  # noqa
 
-SECRET_KEY = os.environ.get("DJANGO_SECRET_KEY", "!!!SET DJANGO_SECRET_KEY!!!")
+# Read from environment variables file
+environ.Env.read_env(os.path.join(BASE_DIR, ".env/.local"))
 
-DEBUG = True
+SECRET_KEY = env("SECRET_KEY")
+
+DEBUG = env("DEBUG", default=False)
 
 # https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts
-ALLOWED_HOSTS = ["localhost", "0.0.0.0", "127.0.0.1"]
 
-EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
+ALLOWED_HOSTS = env.list("ALLOWED_HOSTS")
+
+INTERNAL_IPS = env.list("INTERNAL_IPS")
 
-INTERNAL_IPS = ["127.0.0.1", "10.0.2.2"]
+EMAIL_BACKEND = env("EMAIL_BACKEND")
 
 
 # django-debug-toolbar
diff --git a/{{cookiecutter.git_project_name}}/config/settings/production.py b/{{cookiecutter.git_project_name}}/config/settings/production.py
index d06721d6..5868cc9d 100644
--- a/{{cookiecutter.git_project_name}}/config/settings/production.py
+++ b/{{cookiecutter.git_project_name}}/config/settings/production.py
@@ -1 +1,19 @@
 """Django production settings for {{cookiecutter.git_project_name}} project."""
+
+from .base import *  # noqa
+from django.conf import settings
+
+# Read from environment variables file
+environ.Env.read_env(os.path.join(BASE_DIR, ".env/.production"))
+
+SECRET_KEY = env("SECRET_KEY")
+
+DEBUG = env("DEBUG", default=False)
+
+ALLOWED_HOSTS = ["{{cookiecutter.ALLOWED_HOSTS}}"]
+
+# Check it is safe to run in producion.
+assert not settings.Debug, "DEBUG mode should be off for production."  # nosec
+assert (
+    env("SECRET_KEY") != "!!!UNSECURE_PRODUCTION_SECRET!!!"
+), "SECRET_KEY must be set for production."  # nosec
diff --git a/{{cookiecutter.git_project_name}}/config/settings/staging.py b/{{cookiecutter.git_project_name}}/config/settings/staging.py
index 0263f2f0..d6d06677 100644
--- a/{{cookiecutter.git_project_name}}/config/settings/staging.py
+++ b/{{cookiecutter.git_project_name}}/config/settings/staging.py
@@ -1 +1,19 @@
 """Django staging settings for {{cookiecutter.git_project_name}} project."""
+
+from .base import *  # noqa
+from django.conf import settings
+
+# Read from environment variables file
+environ.Env.read_env(os.path.join(BASE_DIR, ".env/.staging"))
+
+SECRET_KEY = env("SECRET_KEY")
+
+DEBUG = env("DEBUG", default=False)
+
+ALLOWED_HOSTS = ["{{cookiecutter.ALLOWED_HOSTS}}"]
+
+# Check it is safe to run in producion.
+assert not settings.Debug, "DEBUG mode should be off for production."  # nosec
+assert (
+    env("SECRET_KEY") != "!!!UNSECURE_STAGING_SECRET!!!"
+), "SECRET_KEY must be set for production."  # nosec
diff --git a/{{cookiecutter.git_project_name}}/config/settings/test.py b/{{cookiecutter.git_project_name}}/config/settings/test.py
index 89714879..d55d7d64 100644
--- a/{{cookiecutter.git_project_name}}/config/settings/test.py
+++ b/{{cookiecutter.git_project_name}}/config/settings/test.py
@@ -3,7 +3,14 @@
 from .base import *  # noqa
 from django.conf import settings
 
-DEBUG = False
+# Read from environment variables file
+environ.Env.read_env(os.path.join(BASE_DIR, ".env/.testing"))
+
+SECRET_KEY = env("SECRET_KEY")
+
+DEBUG = env("DEBUG", default=False)
+
+ALLOWED_HOSTS = ["{{cookiecutter.ALLOWED_HOSTS}}"]
 
 assert not settings.Debug, "DEBUG mode should be off for testing."  # nosec