---
title: Disabling unnecessary services and keeping the system up-to-date
related:
  - https://docs.kentico.com/13/installation/adding-and-removing-installation-components.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

You should enable only those services, which your web application needs. Otherwise, you provide more opportunities for attackers to infiltrate your system. Many services are installed by default, so you should take care to disable those you do not actually need.

## Server security

If you run your web applications locally on your own servers, then you should check which services run on your server and IIS. Then turn off everything your web application does not need. You should also patch your operating system and server regularly. When a serious security issue is announced, you should patch your system as soon as possible, because attackers are usually able to exploit the flaws within 24 hours.

If your web applications run on remote servers (webhosting, cloud, etc.), you need to trust your provider to ensure the server security.

## Xperience security

Restrict public access to unused files and routes under the administration application's _/CMSPages_ and _/CMSModules//CMSPages_ paths. The following example restricts the public access for the GetCMSVersion.aspx route:

```csharp

<location path="CMSPages/GetCMSVersion.aspx">
    <system.webServer>
        <security>
            <authorization>
                <remove users="public" roles="" verbs="" />
                <add accessType="Allow" users="*" roles=""/>
            </authorization>
        </security>
    </system.webServer>
</location>


```

### Hotfixing

We recommend installing hotfixes only when you need them – in cases when the hotfix repairs bugs that are causing you problems. You can install hotfixes using [KIM](https://docs.kentico.com/13/external-utilities/kentico-xperience-installation-manager.md) or download them from [Xperience DevNet](https://devnet.kentico.com/download/hotfixes).