---
title: Minimal secure configuration
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Your web application should run with the smallest set of rights and permissions required for the application to function correctly. For example, a web application should NOT have access anywhere outside of the web application space. If attackers happen to find a flaw in the web application, at least they will not gain access to sensitive information stored on the server (for example a SAM database, where user passwords are stored).

You should explicitly ensure that:

- IIS runs under a custom low-rights user account.
- The IIS application pool runs under a correctly configured user account. We recommend creating a custom user account with minimum rights. See [Application Pool Identities](https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities).
- The SQL Server Services run under separate low-rights Windows or Local user accounts. See [Configure Windows Service Accounts and Permissions](http://msdn.microsoft.com/en-us/library/ms143504.aspx).
- Unsafe SQL functions, like xp\_cmdshell(), are not enabled.

## Minimal Xperience requirements

Below you can find the minimal configurations for SQL and IIS user accounts required to work correctly with Xperience.

### Minimal configuration for SQL user accounts

Instead of assigning SQL users to the **db\_owner** database-level role, we recommend setting permissions according to the operations that the user account must perform:

| Operations                                                                                                                                                                                                                                                                                                                                                                                             | Required permissions                                                                      |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
| Actions related to **browsing on the live website**                                                                                                                                                                                                                                                                                                                                                    | Alter table or schema, Connect, Delete, Execute, Insert, Select, Update                   |
| Managing of **Forms**, **Page types**, **Custom tables** or **Module classes**<br>**Note**: This set of permissions is required for the DB user of the Xperience administration application, and also your live site application (MVC or ASP.NET Core) if you wish to use certain features, such as the [Form builder](https://docs.kentico.com/13/managing-website-content/forms/composing-forms.md). | Alter schema, Connect, Create table, Create view, Delete, Execute, Insert, Select, Update |
| Working with the [Database objects](https://docs.kentico.com/13/custom-development/managing-database-views-and-stored-procedures.md) application<br>Only required for the DB user of the Xperience administration application.                                                                                                                                                                         | Connect, Create procedure, Delete, Execute, Insert, References, Select, Update            |
| Creating a database<br>Only required for the DB user of the Xperience administration application.                                                                                                                                                                                                                                                                                                      | Alter, Connect, Delete, Execute, Insert, References, Select, Update                       |

To limit the permissions for an SQL user, you have to first create a new SQL login in SQL Management Studio, map it to the database and then assign the permissions for this login. For information about creating logins in SQL Management Studio, see [Create a Login](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/create-a-login).

### Minimal configuration for IIS user accounts

- The account must have **Read**, **Write**, **Modify** permissions for the website directory.