This document contains instructions on how to secure the UI folder (which contain the EPiServer editor and administration interfaces) and also how to ensure that the application will continue to work even if the UI folder is moved to a new location.
Securing the UI Folder
EPiServer CMS allows relocation of the edit and admin folders and configurable HTTP ports, to make it harder for intruders to try to access sensitive resources. By default the edit and admin folders of EPiServer CMS are located in the program files folder on the machines C:\ drive and are linked with Virtual Path Providers. Secure edit/admin and its ports on a default installation of EPiServer CMS as follows:
Step 1: UI Folder
- Change the uiUrl attribute of the siteSettings element in the web.config
file. If you want to secure the UI folder on another port other to that the site
is running on, add an absolute URL including a port other than 80 (or a port
the applicaiton is running on) as shown below:
- Change the UI provider virtualpath attribute from the previous value for
example. "~/UI" to "~/newuipath".
<add name="UI" virtualPath="~/newuipath/" physicalPath="C:\Program Files\EPiServer\CMS\6.0.530.0\application\UI" type="EPiServer.Web.Hosting.VirtualPathNonUnifiedProvider, EPiServer.Framework" />
- Change the location element path attribute from UI to newuipath see below
for an example:
- Change the location element path attribute from UI/admin to newuipath/admin.
Add a specially designated (and restricted) port for access in the Internet
Information Services (IIS) for the site (used for the UI folder in the step 1
above, port 8888 is used for uiUrl). Access to this port could then be
restricted. (This step can be omitted if you only want to change the
The default location ui folder contains the following admin and edit folders:
Step 2: SSL
Using SSL (Secure Sockets Layer) to secure the website and/or UI folder is possible, see the information in the following links:
Change the "physicalPath=" to the site root, for example "C:\EPiServer\Sites\MyEPiServerSite\ui".