--- title: "Securing Experience Platform" slug: "securing-experience-platform" abstract: "Overview of Sitecore Application roles, Storage roles and indexes with links to vendor best practices." --- # Securing Experience Platform Apply vendor best practices to all application roles, storage roles, and indexes. The following list of tasks are specific to Sitecore.

Application roles

 ### xDB Processing The following tasks apply to all core roles: - [Change the administrator password](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password") - [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool") - [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds") - [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT") - [Enable FIPS](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-fips.html "Enable FIPS") - [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles") - [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search") - [Increase login security](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/increase-login-security.html "Increase login security") - [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.md "Limit access to XML, XSLT, and MRT files") - [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption") - [Protect media requests](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-media-requests.html "Protect media requests") - [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website") - [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality") - [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS") - [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client") - [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls") - [IP hashing](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/ip-hashing.html "IP hashing") - [Enforce a strong password policy](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-a-strong-password-policy.html "Enforce a strong password policy") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional tasks should be performed on the xDB Processing role: - [Configure API authentication keys in a scaled environment](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/configure-api-authentication-keys-in-a-scaled-environment.html "Configure API authentication keys in a scaled environment") - [Enforce HTTPS for the xDB Processing service end point](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-the-xdb-processing-service-end-point.html "Enforce HTTPS for the xDB Processing service end point") - [Restrict access to the client](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/restrict-access-to-the-client.html "Restrict access to the client") ### xDB Reporting The following tasks apply to all core roles: - [Change the administrator password](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password") - Deny anonymous users access to a folder - [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool") - [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds") - [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT") - [Enable FIPS](urn:resource:component:255472) - [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles") - [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search") - [Increase login security](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/increase-login-security.html "Increase login security") - [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.md "Limit access to XML, XSLT, and MRT files") - [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption") - [Protect media requests](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-media-requests.html "Protect media requests") - [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website") - [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality") - [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS") - [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client") - [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls") - [IP hashing](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/ip-hashing.html "IP hashing") - [Enforce a strong password policy](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-a-strong-password-policy.html "Enforce a strong password policy") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional tasks should be performed on the xDB Reporting role: - [Configure API authentication keys in a scaled environment](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/configure-api-authentication-keys-in-a-scaled-environment.html "Configure API authentication keys in a scaled environment") - [Enforce HTTPS for the xDB Reporting service end point](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-the-xdb-reporting-service-end-point.html "Enforce HTTPS for the xDB Reporting service end point") - [Restrict access to the client](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/restrict-access-to-the-client.html "Restrict access to the client") ### xConnect Collection service The following tasks apply to all XP Service roles: - [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles") - [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") ### xConnect Collection Search service The following tasks apply to all XP Service roles: - [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles") - [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional tasks should be performed on the xConnect Collection Search service role: - [Enforce HTTPS for xConnect Search](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-xconnect-search.html "Enforce HTTPS for xConnect Search") ### Reference Data service The following tasks apply to all XP Service roles: - [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles") - [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") ### Marketing Automation Operations service The following tasks apply to all XP Service roles: - [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles") - [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") ### Marketing Automation Reporting service The following tasks apply to all XP Service roles: - [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles") - [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") ### Marketing Automation Engine ### xConnect Search Indexer The following additional tasks should be performed on the xConnect Search Indexer role: - [Enforce HTTPS for xConnect Search](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-xconnect-search.html "Enforce HTTPS for xConnect Search") ### EXM Dispatch The following tasks apply to all core roles: - [Change the administrator password](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password") - Deny anonymous users access to a folder - [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool") - [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds") - [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT") - [Enable FIPS](urn:resource:component:255472) - [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles") - [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search") - [Increase login security](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/increase-login-security.html "Increase login security") - [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.md "Limit access to XML, XSLT, and MRT files") - [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption") - [Protect media requests](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-media-requests.html "Protect media requests") - [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website") - [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality") - [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS") - [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client") - [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls") - [IP hashing](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/ip-hashing.html "IP hashing") - [Enforce a strong password policy](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/enforce-a-strong-password-policy.html "Enforce a strong password policy") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional tasks should be performed on the EXM Dispatch role:

Storage roles

 ### xDB Collection database #### SQL provider The following additional tasks can be performed on the xDB Collection database: - [Configure Always Encrypted](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/configure-sql-always-encrypted-for-the-xdb-collection-database.html "Configure SQL Always Encrypted for the xDB Collection database") #### MongoDB provider The following additional tasks can be performed on the xDB Collection database: - Follow the [MongoDB security checklist](https://docs.mongodb.com/manual/administration/security-checklist/) - Set up a [least privilege user](https://doc.sitecore.com/xp/en/developers/100/platform-administration-and-architecture/configure-least-privileged-database-users--mongodb-.html "Configure least privileged database users (MongoDB)") ### xDB Processing Tasks database No additional Sitecore-specific tasks. ### xDB Processing Pools database No additional Sitecore-specific tasks. ### xDB Reference Data database No additional Sitecore-specific tasks. ### xDB Reporting database No additional Sitecore-specific tasks. ### Marketing Automation database No additional Sitecore-specific tasks. ### Message Bus No additional Sitecore-specific tasks. ### EXM database No additional Sitecore-specific tasks.

Indexes

 ### xDB index No additional Sitecore-specific tasks. ### FXM Master index No additional Sitecore-specific tasks. ### FXM Web index No additional Sitecore-specific tasks. ### Master Marketing Assets index No additional Sitecore-specific tasks. ### Web Marketing Assets index No additional Sitecore-specific tasks. ### Master Marketing Definitions index No additional Sitecore-specific tasks. ### Web Marketing Definitions index No additional Sitecore-specific tasks. ### Suggested Test index No additional Sitecore-specific tasks. ### Testing index No additional Sitecore-specific tasks.