Has anyone made Sitecore CM server publicly visible so that anyone can see the Sitecore login page?

My client wants to make content management available to external agencies (who are comfortable using Experience Editor). The CM server is on a private network and the use of IP based restriction, certificates, VPN have all been rejected.

If I follow all the Sitecore security recommendations (https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/securing-xm.html and https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/user-security.html) would it be sufficient to then put the server on the web?


  • I work for a major client, that is very much into having maximum security everywhere in the solution, and their Sitecore login page is accessible to anyone. They haven't had any issues for the past 10 years, so I would guess the answer to your question is yes. – WulfgarDK Aug 12 '19 at 9:42
  • Your site will be accessible by a crawler then, meaning google may eventually index your authoring site. Make sure you have your robots.txt updated to disallow crawling. – Phil Aug 13 '19 at 22:24
  • @WulfgarDK thanks and I am going to go down this route as well. – S Prod Aug 16 '19 at 8:15
  • Thanks for the pointers @Phil – S Prod Aug 16 '19 at 8:15

I worked on multiple projects and one as a high profile client. Everyone CM of every environment is hosted on the web and it is exposed publicly.

So yes sure you can also host your Sitecore CM on the web. But to ensure the security of the CMS they have used the following approach where you can also implement the same.

  • First and foremost they have disabled the robots.txt file from CM server so that the page will not be crawled by the search engine or you can disallow all engine both are fine
  • They have also enabled the IIS Windows / NTLM authentication which provides the extra security on the accessing the Sitecore

These are the major changes we have made to secure our CM site which was hosted on the web and till now we haven't received any issues on that.

So yes sure you can also host your Sitecore CM on the web.

  • Hey Gowtham, it's not possible to have IIS basic authentication on a CM server, is it? Won't it interfere with the login page forms authentication and cause an error? I am getting the following: [AccessDeniedException: Application access denied.] Sitecore.Diagnostics.Assert.HasAccess(Boolean accessAllowed, String message) +81 Sitecore.Shell.Applications.ShellForm.OnLoad(EventArgs e) +62 [TargetInvocationException: Exception has been thrown by the target of an invocation.] ... – S Prod Aug 16 '19 at 13:34
  • Here is an article about it: sagepath.com/blogs/development/articles/… – S Prod Aug 16 '19 at 13:39
  • Hai @SProd I intend to mention the Windows Authentication. I've corrected the answer. Kindle enable the Windows / NTLM auth for extra protection. – Gowthamaraja Eswaramoorthy Aug 16 '19 at 15:11

I have worked on multiple implementations similar implementations, it is suggested to have multi-factor authentication when CM server opened without Ip restrictions.

A clean integration is on v9.2 with sitecore Identity server instance to manage the users cleanly.

https://doc.sitecore.com/developers/92/sitecore-experience-management/en/sitecore-identity.html which inturn uses OWIN and oData integration.


Quick thing could be an upgrade to Sitecore 9.2 and turn-around to Sitecore Identity Server.

  • Thanks @yogi, for now I am on 9.0 so i'll harden the system and go with Gowtham's suggestion – S Prod Aug 16 '19 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.