---
title: Security checklist - deployment phase
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

> **Tip:** If you don't want to spend time configuring and maintaining deployments on your own, consider leveraging our [SaaS](https://docs.kentico.com/documentation/developers-and-admins/saas.md) offering, where Kentico takes care of security, compliance, and infrastructure management for you.

## ASP.NET Core application settings

- Set the `ASPNETCORE_ENVIRONMENT` variable to _Production_ on production instances. ASP.NET Core turns on the [developer exception page](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/error-handling#developer-exception-page), which displays detailed information about unhandled exceptions, only in the _Development_ environment.
- Register an [exception handler](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/error-handling#exception-handler-page) (`UseExceptionHandler`) that shows a generic error page to visitors. The Xperience project templates don't register one.
- Enforce HTTPS with the `UseHttpsRedirection` and `UseHsts` middleware, or let your reverse proxy handle the redirection and the HSTS header. See [Enforce HTTPS in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl).
- Accept only TLS 1.2 or newer, and disable legacy protocols and weak cipher suites.
- Replace the `*` value of the `AllowedHosts` key in _appsettings.json_ with the host names of your application, such as the domains of your website channels. The Xperience project templates allow all hosts. See [Host filtering](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/host-filtering).
- Keep connection strings, client secrets, and API keys out of the _appsettings.json_ files in source control. Load them from a secrets store, such as [Azure Key Vault](https://learn.microsoft.com/en-us/aspnet/core/security/key-vault-configuration), instead of plain text.
- Set _HttpOnly_, _Secure_, and _SameSite_ flags for [cookies](https://docs.kentico.com/documentation/developers-and-admins/data-protection/cookies.md#set-and-work-with-cookies).
- If the application runs on more than one instance or in containers, persist the [ASP.NET Core Data Protection](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview) key ring to persistent storage that all instances share, and restrict access to the storage to the application's identity. SaaS projects get this configuration from the project template.

## Xperience settings

- Set a specific `CMSHashStringSalt` value before the first deployment, and store it with your other secrets. The system uses the salt to create [macro signatures](https://docs.kentico.com/documentation/developers-and-admins/configuration/macro-expressions/macro-signatures.md).
- Keep [Continuous Integration](https://docs.kentico.com/documentation/developers-and-admins/ci-cd/continuous-integration.md) disabled on production instances.
- Don't register the [management API](https://docs.kentico.com/documentation/developers-and-admins/api/management-api.md) (`AddKenticoManagementApi`) on production or other publicly available instances.
- Behind a reverse proxy or load balancer, configure the [Forwarded Headers Middleware](https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud/run-xperience-by-kentico-behind-a-proxy-server.md) with the addresses of your proxies. Xperience resolves the current website channel from the request's host name.
- Set up [rate limiting](https://docs.kentico.com/documentation/developers-and-admins/security-guidelines/rate-limiting.md) for public endpoints with a high workload. By default, Xperience limits only the user management endpoints of the administration.
- Update Xperience to the latest hotfix before you deploy, and follow the [security advisories](https://docs.kentico.com/changelog/security-advisories.md). Only the latest release contains all security fixes.

## Hosting environment

- Apply the latest patches for the .NET runtime, your web server, and the operating system.
- Run each application under its own least-privilege identity. Don't share identities between instances of different applications.
- Enable [logging](https://docs.kentico.com/documentation/developers-and-admins/development/logging.md) and monitor the logs for anomalies.

## Cloud and deployment security

- Use managed identities and apply the least-privilege access level.
- Store secrets in [Azure Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/secrets/secure-secrets) or similar.
- Enable Web Application Firewall (WAF).
- Enable logging and monitoring via [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/overview) or similar.
- Harden your infrastructure to ensure high-availability and security of all resources.
- Establish disaster recovery plans and validate them periodically.