I've a Sitecore 7.5 with Lucene in a server that uses an antivirus which has Real Time Protecion enabled, and NO policies for exclusion.

My idea was to add in the exclusion list the IIS Process (w3wp.exe) and the Sitecore instance folder (including Website and Data).

That being said, I was looking for some advices in how to properly add Sitecore in the exclusion list and not getting a breach in my security.

Is there any way to achieve that? Which files are more important to exclude?

2 Answers 2


Exclude everything in the /Data folder except for packages folder. The packages folder is the only folder that an external user could upload data to.

  • Should I consider excluding any DLLs and/or config files? Commented Feb 9, 2018 at 15:47
  • 1
    I would not exclude anything in the website as that is public facing. If someone dropped a script on the server, the AV would catch it. If you deploy with update package (like TDS). Then you could consider excluding the /temp folder. But I would only do that if deployment speed was an issue.
    – Chris Auer
    Commented Feb 9, 2018 at 16:05

The official documentation states:

Some antivirus software can have a detrimental effect on the performance of ASP.NET applications including Sitecore. We therefore recommend that you use only antivirus scanners that are certified for the operating system that you use. For more information about the certified products, see the Windows Server Catalog website.

To ensure optimal performance, exclude the following folders from scanning by your antivirus software:

  • The site root folder.
  • The data folder that is defined in the setting in the web.config file.
  • The folder that contains the actual Sitecore database files.
  • The C:\Windows\Temp or {app_pool user profile}\Temp folder

DO NOT exclude at least, any folder of the website where the Application pool has write access, and I think it's worth any minor performance degradation and DO NOT exclude the website root and run some performance test before and after to be sure it won't kill your site.

In terms of dlls and config files, it's known that some antivirus touches these files during their scans, forcing an application pool restart, which could lead to a lot of problems. After installing your antivirus, and running a full cycle (real-time scans and any scheduled scan) check if the application pool is restarted with entries in Sitecore's logs about modified files. If you find this problem, exclude those extensions too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.