---
title: "Security tasks"
slug: "security-tasks"
abstract: "Introduction to the Sitecore security and hardening tasks you should address - especially in a production environment."
---
# Security tasks

This section lists all security hardening and security configuration tasks in no particular order. Each topic includes information about which role is affected.

Refer to the following topics for a list of security tasks organized by role:

- [Securing Experience Manager](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/securing-experience-manager.html "Securing Experience Manager")
- [Securing Experience Platform](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/securing-experience-platform.html "Securing Experience Platform")
- [Securing Experience Commerce](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/securing-experience-commerce.html "Securing Experience Commerce")

## Security tasks

- [Change the administrator password](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/change-the-administrator-password.html "Change the administrator password")
- [Configure API authentication keys in a scaled environment](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/configure-api-authentication-keys-in-a-scaled-environment.html "Configure API authentication keys in a scaled environment")
- [Disable administrative tools](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enable-and-disable-an-administrative-tool.html "Enable and disable an administrative tool")
- [Disable client RSS feeds](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/disable-client-rss-feeds.html "Disable client RSS feeds")
- [Disable SQL Server access from XSLT](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/disable-sql-server-access-from-xslt.html "Disable SQL Server access from XSLT")
- [Enable client certificate authentication](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enable-or-disable-client-certificate-authentication-for-xp-service-roles.html "Enable or disable client certificate authentication for XP service roles")
- [Enable FIPS](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enable-fips.html "Enable FIPS")
- [Enforce HTTPS for XP service roles](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-experience-platform-service-roles.html "Enforce HTTPS for Experience Platform service roles")
- [Enable HTTPS for core roles](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-core-roles.html "Enforce HTTPS for Core roles")
- [Enable HTTPS for Content Search](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enable-https-for-content-search.html "Enable HTTPS for Content Search")
- [Enforce HTTPS for xConnect Search](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-xconnect-search.html "Enforce HTTPS for xConnect Search")
- [Enforce HTTPS for the xDB Processing service end point](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-the-xdb-processing-service-end-point.html "Enforce HTTPS for the xDB Processing service end point")
- [Enforce HTTPS for the xDB Reporting service end point](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-the-xdb-reporting-service-end-point.html "Enforce HTTPS for the xDB Reporting service end point")
- [Enable HTTPS for the Content Publishing role](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/enforce-https-for-the-content-publishing-role.html "Enforce HTTPS for the Content Publishing role")
- [Increase login security](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/increase-login-security.html "Increase login security")
- [Limit access to .XML, .XSLT, and .MRT files](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/limit-access-to-xml,-xslt,-and-mrt-files.html "Limit access to XML, XSLT, and MRT files")
- [Change the hash algorithm for password encryption](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/change-the-hash-algorithm-for-password-encryption.html "Change the hash algorithm for password encryption")
- [Protect media requests](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/protect-media-requests.html "Protect media requests")
- [Remove header information from responses sent by your website](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html "Remove header information from responses sent by your website")
- [Restrict access to the client](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/restrict-access-to-the-client.html "Restrict access to the client")
- [Secure the file upload functionality](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/secure-the-file-upload-functionality.html "Secure the file upload functionality")
- [Limit access to PhantomJS](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/limit-access-to-phantomjs.html "Limit access to PhantomJS")
- [Secure Sitecore.Services.Client](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/secure-sitecore-services-client.html "Secure Sitecore.Services.Client")
- [Secure the Telerik controls](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/secure-the-telerik-controls.html "Secure the Telerik controls")
- [IP hashing](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/ip-hashing.html "IP hashing")
- [Separate Content Management and Content Delivery servers](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/separate-content-management-and-content-delivery-servers.html "Separate Content Management and Content Delivery servers")
- [Configure SQL Always Encrypted for the xDB Collection database](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/configure-sql-always-encrypted-for-the-xdb-collection-database.html "Configure SQL Always Encrypted for the xDB Collection database")
- [Configure least privileged database users (MongoDB)](https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/configure-least-privileged-database-users--mongodb-.html "Configure least privileged database users (MongoDB)")