--- title: "Securing Experience Manager" slug: "securing-experience-manager" abstract: "Overview of Sitecore Application roles, Storage roles and indexes with links to vendor best practices." --- # Securing Experience Manager Apply vendor best practices to all application roles, storage roles, and indexes. The following list of tasks are specific to Sitecore.

Application roles

 > [!note] > The XP Single topology technically supports a combined Content Delivery/Content Management role. This [combination is not recommended in a production environment](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/separate-content-management-and-content-delivery-servers.html "Separate Content Management and Content Delivery servers"). ### Secure the Content Delivery role The following tasks apply to all core roles: - [Allowing or denying users access to web resources](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/allow-or-deny-users-access-to-web-resources.html "Allow or deny users access to web resources") - [Change the administrator password](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password") - [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool") - [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds") - [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT") - [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles") - [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search") - [Increase login security](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/increase-login-security.html "Increase login security") - [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.html "Limit access to XML, XSLT, and MRT files") - [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption") - [Protect media requests](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/protect-media-requests.html "Protect media requests") - [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website") - [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality") - [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS") - [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client") - [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls") - [IP hashing](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/ip-hashing.html "IP hashing") - [Enforce a strong password policy](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enforce-a-strong-password-policy.html "Enforce a strong password policy") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional tasks should be performed on the Content Delivery role: - [Restrict access to the client](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/restrict-access-to-the-client.html "Restrict access to the client") > [!important] > [Enabling FIPS](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-fips.html "Enable FIPS") is no longer mandatory. Only enable it if you're legally required to do so. ### Secure the Content Management role The following tasks apply to all core roles: - [Allowing or denying users access to web resources](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/allow-or-deny-users-access-to-web-resources.html "Allow or deny users access to web resources") - [Change the administrator password](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password") - [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool") - [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds") - [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT") - [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles") - [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search") - [Increase login security](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/increase-login-security.html "Increase login security") - [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.html "Limit access to XML, XSLT, and MRT files") - [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption") - [Protect media requests](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/protect-media-requests.html "Protect media requests") - [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website") - [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality") - [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS") - [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client") - [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls") - [IP hashing](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/ip-hashing.html "IP hashing") - [Enforce a strong password policy](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enforce-a-strong-password-policy.html "Enforce a strong password policy") - [Protect the connection string passwords from unauthorized access](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/protect-the-connection-string-passwords-from-unauthorized-access.html "Protect the connection string passwords from unauthorized access") The following additional task should be performed on the Content Management role: - [Configure API authentication keys in a scaled environment](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/configure-api-authentication-keys-in-a-scaled-environment.html "Configure API authentication keys in a scaled environment") > [!important] > [Enabling FIPS](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enable-fips.html "Enable FIPS") is no longer mandatory. Only enable it if you're legally required to do so. ### Secure the Content Publishing role The following tasks should be performed on the Content Publishing role: [Enable HTTPS for the Content Publishing role](https://doc.sitecore.com/xp/en/developers/104/platform-administration-and-architecture/enforce-https-for-the-content-publishing-role.html "Enforce HTTPS for the Content Publishing role")

Storage Roles

 ### Web database No additional Sitecore-specific tasks. ### Master database No additional Sitecore-specific tasks. ### Core database No additional Sitecore-specific tasks. ### Private Session State Store No additional Sitecore-specific tasks. ### Shared Session State Store No additional Sitecore-specific tasks. ### Forms database No additional Sitecore-specific tasks.

Indexes

 ### Web index No additional Sitecore-specific tasks. ### Master index No additional Sitecore-specific tasks. ### Core index No additional Sitecore-specific tasks.