What to verify before deploying a .NET web app, from build artifacts to safe rollbacks. The sections below outline a useful way to evaluate the work, choose sensible next steps and avoid expensive assumptions.
Start with the hosting contract
Before publishing, confirm the hosting provider supports the target .NET runtime and the ASP.NET Core Module if the app will run behind IIS. The presence of legacy ASP.NET Framework controls does not, by itself, prove that a modern ASP.NET Core app will work. Ask for the operating system, runtime version, hosting permissions and any app-pool requirements.
Publish what the server actually needs
A Release publish is different from copying a Visual Studio project folder. The published output includes application assemblies, dependency manifests, configuration and static files. The web root belongs inside wwwroot; the deployment directory contains the executable, libraries and server configuration. Verify the published output before uploading.
Keep secrets out of your deployment archive
Never include mailbox passwords, signing keys or API secrets in public source files or frontend JavaScript. Use hosting-supported environment variables or a private server configuration file outside wwwroot with restricted access. Local User Secrets are for development and are not automatically transported to production.
Make changes reversible
Keep a recoverable copy of the previous deployment and record which build went live. Avoid deleting unrelated hosting files or changing mail records during a web-app update. After the upload, check the homepage, critical navigation, application health and each user-facing form. If a critical check fails, restore the earlier verified deployment.
Treat email as a separate dependency
A form can load successfully while SMTP delivery is unavailable. Verify the authenticated SMTP hostname, TLS mode and port, then submit a real test inquiry and confirm that the mailbox receives it. Test replying to an external address separately; an accepted SMTP message is not a promise of final inbox delivery.