---
title: Handling error messages securely
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Displaying information to users in error messages is an important issue which you should pay attention to. Revealing some pieces of information (for example stack trace or debug data) can pose a security risk to your site, while not providing enough information would not help the users at all. To ensure that the error messages in your system are handled properly, follow these procedures:

- Design error messages in a way that does not allow potential attackers to gain exploitable knowledge about the system. See [Designing secure error messages](https://docs.kentico.com/13/securing-websites/developing-secure-websites/handling-error-messages-securely/designing-secure-error-messages.md).
- Create your own error pages, which will be displayed instead of the default ones. It is important to present unified error messages throughout the system, for all types of errors. See [Handling 404 errors](https://docs.kentico.com/13/securing-websites/developing-secure-websites/handling-error-messages-securely/handling-404-errors.md).
- Before going live with your website, disable debugging in error messages. See [Web.config security settings](https://docs.kentico.com/13/securing-websites/deploying-websites-to-a-secure-environment/web-config-security-settings.md#error-messages-and-disabling-the-debug).