Inspired by my former colleague Alexander Haneng's deployment checklist for EPiServer, I wanted to create one for Umbraco. Mainly as a reminder to myself and hopefully the list can get some additions from the community. Most of the points are not specific to Umbraco, but general to all ASP.NET MVC deployments. The list is not sorted or prioritized in any particular way, but I have grouped the items in a way that seems logical to me.
| Title | Description |
|---|---|
| Separate drive | You do not want the system drive to run out of free space, so make sure the website, logging (both IIS and Umbraco), Umbraco media folder, search index, caching etc are stored on a separate drive |
| Backup and monitoring | Ensure that both web server and SQL Server are constantly monitored and regularly backed up |
| Title | Description |
|---|---|
| Release mode | All DLL's in production environments should be built in Release mode |
| Minified CSS and JS | If possible, all JavaScript and CSS files should be bundled and minified. I use Mindscape Web Workbench but there are loads of options |
| Remove debug stuff | Search through your entire project for lines that you usually use for testing/debug and remove the ones that will display in your html, css or javascript. "console.log", "todo", "lorem ipsum", "test" etc. |
| Google Analytics | If you use Google Analytics, make sure the tracking code is correct |
| Caching | Make sure the code leverages caching offered by the framework. Look here and here |
| Title | Description |
|---|---|
| Debug = false | Seems like the most obvious thing in the world, but I still stumble upon sites with compilation debug set to true in production environments |
| Force WWW | To keep consistent URLs on my site, I like to force my website to be visited with the WWW prefix. One way to ensure this is using a simple URL rewrite rule |
| Verify all paths | Search for ":" and "\\" in all config files and check that all paths are correct |
| Verify appsettings and connectionstring | make sure they have the correct values for production environment |
| Encrypt connectionstrings | Don't keep connectionstrings in plaintext in the demilitarized zone. [Separate the connectionstring section] (http://stackoverflow.com/questions/6582970/separate-connectionstrings-and-mailsettings-from-web-config-possible) and encrypt it on the web server (Remember: You cannot encrypt the file on one server and transfer it to another. You must copy the file in plaintext and do the encryption on each server) |
| Security headers | Analyze security headers at Securityheaders.io and add the missing ones |
| Title | Description |
|---|---|
| SSL | No excuses. Get a certificate and make sure that information sent between your site and the users are encrypted. Analyze your website at SSLLABS and try to get an A. Read Sebastiaans great blog post about securing Umbraco Remember to add <add key="umbracoUseSSL" value="true" /> in web.config! |
| No logging until needed | Turn off logging (both IIS and Umbraco) until needed. (Not everyone will agree, and if you have a low-traffic website you can ignore this part. I usually do like this: Keep logging on for 2 weeks. If everything runs smooth I turn it off until things get shaky) |
| App pool recycle | Create a separate Application Pool for the site and schedule a nightly recycle |
| Robots.txt | Do you need search engines to ignore parts of your page? |
| Sitemap.xml | Consider to include a sitemap.xml on your site |
| 404 | Do you handle 404's in a decent way? |
| 500 | Do you handle 500's in a decent way? Custom error page |
| Print.css | Sounds crazy, but some people actually print web pages |
| Title | Description |
|---|---|
| Latest version | Update to latest (stable) version |
| Disable Version Check | [Set umbracoVersionCheckPeriod = 0] (https://our.umbraco.org/wiki/reference/webconfig) |
| Silent/Inline macro errors | In the umbracoSettings.config set MacroErrors to inline or silent (if you choose inline, this PR now makes it possible to change the default error message |
| Files and images | Verify that files and images can be uploaded to the site |
| Scheduled tasks | Verify that schedule tasks are running |
| Search | Test some search queries |
| Access to backoffice | Do you want to expose the ".../Umbraco" URL to everyone or limit it to your local network? Check out this blog post to restrict access to backend by IP address |
| Redirect old URLs | Are you replacing an old site with new URLs? Go through analytics data and set up 301 redirects for the most popular pages. The 301 URL Tracker makes it easy, and is planned implemeted in the core for 7.5.0 |
| Forms | Using Umbraco Forms? Make sure it's the correct license and try to submit a test form |
| Cold boot | Delete cache and search index. Restart site. [Republish site] (https://our.umbraco.org/wiki/reference/api-cheatsheet/publishing-and-republishing/) Reindex |
| Title | Description |
|---|---|
| Page titles | One h1 tag on each page? |
| Meta data | HTML meta tags |
| Alt text | Images have alt text? |
| Broken links | Check site for broken links. I Use LinkChecker |
| Favicon | Add favicon |
| Google Webmaster Tools | With Google Webmaster tools you can tell google to reindex your site quicker after a release. |
| Google PageSpeed Insights | Analyze and try to improve the score for the site |
TODO!