There are a number of things we want to ensure on our production servers:
The debug attribute in the compilation element in the web.config should be false for all applications. This is mainly for performance reasons, leaving it to false means:
1) The compilation of ASP.NET pages takes longer (since some batch optimizations are disabled)
2) Code can execute slower (since some additional debug paths are enabled)
3) Much more memory is used within the application at runtime
4) Scripts and images downloaded from the WebResources.axd handler are not cached
Page output tracing should be disabled, again for performance reasons.
The customErrors element should be in remoteOnly mode. This means the custom error page will be shown to remote users rather than the actual exception or error message. We never want to output visible errors to users!
Luckily, we can ensure all the above happens using one simple config setting in the machine.config on the web server:
<system.web> <deployment retail="true" /> <system.web />
Additional info can be found in the MSDN documentation.