Alexander Haneng
Sep 21, 2011
(4 votes)

EPiServer CMS Checklist: Deployment Checklist

This is a checklist with things you should check when deploying a new EPiServer CMS 6/CMS 6 R2 site. It might look like a lot of work, but I promise you it will be less work in total since you will have less things that goes wrong after the site is set into production. Remember: Even seasoned pilots go through their checklists at the start of every flight!


Run through the Starting Development Checklist first!

If you didn’t run through the Starting Development Checklist at the start of your project you should do so now. Please note that some of the items are on both lists.


The Dropit list

This list of course greatly influenced by the excellent Checklist for deploying EPiServer sites on the Dropit blog by Andreas Nylin. Dropit: I hope it is OK that I have included many of the great points from your list.


Feedback wanted

This list is by no means the definitive list of what to do when deploying an EPiServer CMS site, but more a collection of my own experience, experiences made by my excellent colleagues here at Making Waves and of course all the great blog posts out there. And as such I am going to update the list with your feedback so please leave your feedback in the comments.


Important: Use at your own risk

This list is meant as a help when deploying sites, but comes with no guarantees. Use at your own risk.




Order EPiServer licenses

Make sure to order EPiServer licenses well in advance for all the EPiServer products you use. EPiServer does not issue licenses outside office hours and might be closed for Swedish public holidays. Upgrading from CMS 6 to CMS 6 R2? Read this.


Order other licenses

If your site needs other licenses make sure to order tem well in advance.


DLLs Built for Release


Verify that all DLLs are built in “Release” mode

Reason: Performance




Create a separate Application Pool for the site and recycle at 05:00 AM

Every site should run in its own Application pool. The app pool should be automatically recycled at 05:00AM. IIS 7.5: Go to “Application Pools”, select the correct pool. Click “Recycling…” on the right side. Uncheck “Regular time intervals”. Check “Specific time(s)” and write “5:00 AM”. Click Next and Finished.


Disable IIS logging

Logging should be disabled until it’s needed. IIS 7.5: Logging - > Click “Disable” on the right side


Redirect non www address

Set up a redirect to redirect traffic from to

IIS 7.5: Install the URL Rewrite IIS module from Microsoft: (Requires Administrator access, size: 6MB)

Click on “URL Rewrite” icon in IIS. Click “Add Rule(s)...” on the right side. Choose “Canonical domain name” template. Rename rule to “Redirect non-www domain name”.


IIS 7/7.5: Check that compression is on

Click the “Compression” icon. Check that both “Enable dynamic content compression” and “Enable static content compression” are turned on. If “dynamic compression” is greyed out you need to install the IIS module first. 




Set compilation debug to false

Set the debug attribute of the compilation section to false.


Set attributes for mailsettings section

- host = the mail server that should be used to send mails
- from = set to an address or remove 
- port, userName, password (for mail server if needed)


Search for ":\" and “\\” and check that all paths are correct

Verify that all file system paths are correct.


Check access rights in web.config

Check the authorization section under each location section and verify that the specified groups are correct.




Turn on output cache

httpCacheExpiration = 01:00:00 (one hour)
httpCacheVaryByParams = id,epslanguage + any other query string names you might use on the site (like page,query etc.)


httpCacheExpiration="01:00:00" httpCacheability="Public" httpCacheVaryByCustom="path" httpCacheVaryByParams="id,epslanguage,page,query"


Set uiMaxVersions = 20

Set uiMaxVersions to 20 in the episerver.config file (in sitesettings). It is important to set this property before the site goes into production as changing it later is difficult. (You would have to republish EVERY page on the site)

Reason: The default setting is to keep unlimited number of versions of each page. This is a problem for two reasons: 1. Performance 2. The version list gets very long for editors


Verify paths for VPP (virtualPath/Providers)

Check that all the physicalPath attributes point to the right file paths.


Set siteUrl =

Set uiUrl ={ui}/

Set utilUrl =


Set SiteDisplayName = (Should be the actual name of the site)




Verify that the right databases and users are specified



  Set level value="Off"

Logging should be disabled until it’s needed for better performance.




Verify that a robots.txt file exists and is correct

The robots.txt should be located in the root of the site look like this: (Make sure NOT to add edit and admin mode paths as they should be kept secret)

User-agent: *
Disallow: /Util/


Google Analytics

  Verify that Google Analytics scripts are included in the page and that the correct key is specified.

Access rights in EPiServer (Admin mode)


Make sure you only use the SQL membership provider

Make sure you don’t use the Windows membership provider. Verify by viewing users in admin mode.


Remove test users and groups in EPiServer

Go through the list of users and groups and remove those that shouldn’t have access to the site.


Create a new support user

Create a new user with edit and admin rights for debugging/support use. Make sure to choose a non-obvious user name and a very strong password. Document the chosen user name and password for future use.


Check access rights in the EPiServer page tree

Make sure that Administrators and Editors have the correct access levels. Remove everyone from pages that shouldn’t be accessed by normal users.


Editors should not have admin rights

Avoid giving editors admin rights to prevent tampering with page types etc. Only one or two people at the customer’s should have admin rights (to be able to create new users, unlock accounts etc.)

Please note: You need admin rights to be able to edit the value of dynamic properties!


Scheduled jobs (Admin mode)


Verify that scheduled jobs are active

Setup scheduled jobs to run in an appropriate interval.


Files (VPP)


Add VPP write access rights to web editors

Web editors don't have write access to the VPP folders as default. In edit mode open the file manager and click on the key icon. Add "Create", "Change" and "Delete" rights to "WebEditors" for each VPP folder ("Global Files", "Documents" etc.)


Verify that files can be uploaded to the site

Log in as an editor (without admin rights) and upload a file in edit mode.




Verify that mails sent from forms are sent and received

Try sending email by filling out an XForm and try any custom email sending functionality.




Perform test searches and verify that relevant results are shown


Check external access


Do a check of the site in

Go to and type in the domain name of the site and click the “simple” button. Verify that you can see the text from the front page and the main menu as links. If you have a mobile version of the site also, make sure you get the full version.

Reason: This tests that the site is available externally, visible to search engines and that the mobile version of the site is not delivered to search engines.




Extra Checklist for Load Balanced Sites (Enterprise)

Cache Invalidation


Check that publishing causes cache invalidation

Publish a new page on Server A. Make sure the page appears on Server B. Make a change to the page on Server A. Make sure the change is visible on server B.




Check that VPP is accessible from all servers


Scheduled Jobs


Make sure Scheduled Jobs only runs on one server

Having the same scheduled jobs running on multiple servers is a bad idea, so make sure only one server runs the jobs. Set enableScheduler to false in siteSettings for all servers except one (episerver.config).



Update 29.09.2011:

Set stringDelayedLoadThreshold = 50

Due to an issue with setting stringDelayedLoadThreshold to something else than 0 and LinkItemCollections and problems with some custom properties this item has been removed from the list.


Update 20.01.2012:

-Added information about enabling “dynamic compression” by installing IIS module

-Added the item “Add VPP write access rights to web editors


Good luck with your deploy!

Posted by

Sep 21, 2011


Sep 21, 2011 02:27 PM

-Turn on error handling and make sure you have a error pages for the site.
-If there is an existing site on the domain create 301 redirects for the parts that need it.

tompipe Sep 21, 2011 03:11 PM

Some good suggestions, but one point I'd question is "Disable IIS logging. Logging should be disabled until it’s needed."

I personally find that IIS Logging generally isn't needed UNTIL you discover something like a hacking attempt where you need an audit trail and therefore logging. If it gets switched off by default after deployment you can't 'go back in time' to investigate and will inevitably wish that logging was enabled! :)

So IMHO logging should be enabled, but properly monitored and managed (e.g not saved on the system drive and archived/disposed regularly) Sep 21, 2011 03:27 PM

I believe I've read that there's no problems having the scheduled jobs active on all servers - first that takes it wins and the second will see that the job has run?

Sep 22, 2011 10:49 AM

Great post, I think a lot of people will use this

Sep 28, 2011 02:52 PM

Checklist updated: Removed stringDelayedLoadThreshold = 50. See note at the end of the checklist.

Oct 28, 2012 01:00 AM

Thanks, great tips here! I'm new to EPiServer so providing the reasons and detailed descriptions help a lot.

Please login to comment.
Latest blogs
Performance optimization – the hardcore series – part 2

Earlier we started a new series about performance optimization, here Performance optimization – the hardcore series – part 1 – Quan Mai’s blog...

Quan Mai | Oct 4, 2023 | Syndicated blog

Our first steps into local AI

After a consumer of tools like ChatGPT and CoPilot, we as developers like to dive deeper into it. How does it work? Where to start? Can I create my...

Chuhukon | Oct 4, 2023 | Syndicated blog

Update on .NET 8 support

With .NET 8 now in release candidate stage I want to share an update about our current thinking about .NET 8 support in Optimizely CMS and Customiz...

Magnus Rahl | Oct 3, 2023

Adding Block Specific JavaScript and CSS to the body and head of the page

A common requirement for CMS implementations includes the ability to embed third party content into a website as if it formed part of the website...

Mark Stott | Oct 3, 2023