Sitecore and SSL

With the new rules surrounding data being increasingly more important, we must all take the necessary steps to ensure that the data being used on the sites we develop is transferred from client to server securely.

To enable SSL in your sitecore site, you will need to make sure that the following has been set.

1 – Specify the schema in your configurtation

<site name="sitename" patch:after="site[@name='modules_website']" 
targetHostName="" port="443" externalPort="80" scheme="https" />

Note: Do not place the scheme in the targetHostName. You will end up with double scheme names in your url e.g http://http://

2. Adding an IIS rewrite rule

IF you have users who load the URL via HTTP. Force them not to

 <rule name="ForceSSL" stopProcessing="true">
 <match url="(.*)" />
 <add input="{HTTPS}" pattern="^OFF$" />
 <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />

Task runner cant load tasks

Moving a Gulp file outside of your web root can cause visual studio too loose visibility and stop running your gulp taks.

To enable visual stuido to see your gulp task file

  • Go to Tools > Options > Projects and Solutions > External Web Tools
  • Reorder so that $(PATH) is above $(DevEnvDir)\Extensions\Microsoft\Web Tools\External

Thanks to the stack overflow post of this answer 

Slow Azure websites with Redis

During a load test of an Azure website, we noticed that the site started to become unresponsive when 10 concurrent users we loaded.

Session management has been utilized through a Redis cache. For anyone looking to use this I would recommend here as a good starting point.

Deploying the site locally using the live web.config transforms, we were able to run the following in the command line, to show all connections that were being made from the computer.

netstat -b

It was noticed that there were over 100 concurrent connections being made to the cache which stopped the site from being able to connect to the azure portal.


The azure portal had displayed the following recommendations to fix the portal



This was due to the concurrent connections being maxed out a 256 connections.


What was the culprit? Creating a new connection every time the class was instantiated.

It is recommend in the by MSDN to create a static instance of the connection that is shared across the application. This can either be achieved by using a singleton pattern, using dependency injection or by using the below code.

private static Lazy _redisConnection = new Lazy(() => 

This then happened.



Restricting your Umbraco web apps in Azure

Restricting access to a clients website can be a common practice. This usually means that they will need to have access give to an IP address or a range of IP addresses.

These details can usually be obtained from the clients IT administrators.

Typically during CMS development, you will have two instances of your application – delivery (Front end, with no access to the CMS) and an authoring (Front end and CMS access) and both of these instances will be found in each development environment.

Its usually good practice to restrict all access to development / UAT / SIT environments to your clients IP address. This allows for developments to be approved by the client before being released.

IP white listing will block all connections to the website in IIS unless it is specified on the list. Using a web.config transform would be the way to ensure that the restrictions get applied to the correct environment.

Step 1 – Create the white list. 

In App_Config create a new config file called ipSecurity.config

<?xml version="1.0"?>
<ipSecurity allowUnlisted="false">

Step 2 – Local IP 

 <add allowed="true" ipAddress="" />

Step 3 – Internal IP addresses

This will be your office IP address.

Step 4 – External IP addresses

This will be all of your stake holders in the project external to your company

Step 5 – Add your outbound IP Addresses

These are range of IP addresses that could be used, as Azure currently doesn’t support static outbound IPs. If you need a static IP, you could configure a custom domain.

Step 6 – Error handling 

Once locked down by IP, everything that interacts with the website will also be denied access including Application Insights.You will need to included all the IP addresses for Telemetry, Live Metrics Stream and Availability tests.
Availability web test is essentially a ping test that is run every few minutes to ensure your application is alive.

The range of up to date IPs that need to be added can be found here

Step 7 – Adding the list to web.config

Add the following code to you transform to apply the list.

           configSource="App_Config\ipSecurity.config" />

You should only apply this to the sites you need to restrict, with the exception of the public facing delivery application, otherwise your users wound be able to access the site! 😉


Creating thumbnails from the front page of a PDF with ghostscript

Automation is such as wonderful thing.

  1. install Ghostscript to your computer.
  2. Create a C# console app
  3. Copy the following code into your app and replace <<VERSION NUMER>> with your version number.
  4. Pass in the link to the PDF file, the folder name and the file name.
 public void PdfToJpg(string inputPDFFile, string outputImagesPath, string filename)
     string ghostScriptPath = $"C:\Program Files (x86)\gs\gs<<VERSION NUMBER>>\bin\gswin32.exe";
     string ars = $"-dNOPAUSE -sDEVICE=jpeg -dFirstPage=1 -dLastPage=1 -r102.4 -o \"{outputImagesPath}\\{filename}.jpg\" -sPAPERSIZE=a4 \"{inputPDFFile}\"";
     Process proc = new Process();
     proc.StartInfo.FileName = ghostScriptPath;
     proc.StartInfo.Arguments = ars;
     proc.StartInfo.CreateNoWindow = true;
     proc.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;