B2C Commerce Hyperforce Realm Move — Pre-Move Checklist, Move Timeline, and Post-Move Verification

Pre-Move Checklist (Complete at Least 30 Days Before Move)

All five tasks below must be completed before your realm move. The Salesforce Support team will confirm pre-move readiness before scheduling the move window.

Task 1: Enforce HTTPS

Hyperforce enforces a strict security model that requires HTTPS for all network traffic. HTTP-only connections are automatically rejected by Hyperforce infrastructure — this is an architectural requirement, not a configurable option. Any integration, webhook, or storefront URL using HTTP (not HTTPS) will break immediately after the move. https://help.salesforce.com/s/articleView?id=002888834&type=1
Action: In Business Manager, go to Administration → Global Preferences → Security → Access Restriction tab and enable Enforce HTTPS. Audit all third-party integrations for HTTP callback URLs and update them to HTTPS before the move.
Refer to the Enforce HTTPS for B2C Commerce documentation for full details.

Task 2: Update Firewall Allowlists for All Integrations

Hyperforce POD infrastructure has different outbound IP addresses than legacy POD infrastructure. Any third-party system (payment processors, ERP, PIM, OMS, fraud tools) that uses IP-based allowlisting to accept inbound connections from B2C Commerce must add the new Hyperforce IP addresses before the move.
Action: Add all Hyperforce outbound IPs listed in the IP Allowlist by Region section below to the firewall settings of every third-party integration. All regions must be allowlisted — not just your primary region — because Hyperforce may route traffic from an alternate region during a failover event.

⚠️ 72-hour freeze: Do not submit firewall change requests in the 72 hours immediately before your realm move. Changes made during this window can interfere with the data replication process that begins approximately 5 hours before the move starts and may cause data inconsistency. Submit all firewall changes at least 4 days before the move date. https://help.salesforce.com/s/articleView?id=002888834&type=1

Task 3: Migrate Legacy eCDN Zones to Proxy Zones

Legacy storefront zones are not supported on Hyperforce infrastructure and must be migrated to proxy zone configuration before the move. After migration, the legacy zone must be deleted.
Benefits of proxy zones (required for Hyperforce):

• Standardised eCDN with access to the latest Cloudflare security features
• Auto-renewing eCDN managed SSL certificates (no manual renewal required)
• Improved troubleshooting and traffic analysis

Action: In Business Manager, go to Administration → Sites → Embedded CDN Settings to identify any legacy zones. Follow the eCDN Proxy Zone FAQ for migration steps. Delete the legacy zone after migration is confirmed.

Task 4: Configure 2FA Client Certificates for WebDAV

WebDAV authentication is moving to the eCDN layer for Hyperforce. Code uploads to Staging require client certificates uploaded to the eCDN. Without this configuration, developers will be unable to upload code after the move. https://help.salesforce.com/s/articleView?id=002888834&type=1
Action:

1. Generate a self-signed certificate bundle
2. Upload the self-signed root CA certificate via the Business Manager UI or CDN API
3. Configure the client certificate to use the same self-signed root CA certificate

Task 5: Update Email Configuration (If Using Salesforce SMTP Service)

If your realm uses the Salesforce SMTP service to send transactional emails (order confirmations, account registration), the email domains used for sending must be listed and approved before the move. SPF records must reference the Production domain — not an IP address — to ensure seamless email delivery after the move. https://help.salesforce.com/s/articleView?id=002888834&type=1
Action:

1. In Business Manager, go to Administration → Operations → Email Settings → Domains and confirm all sending domains are listed and approved
2. Add required DNS records via Administration → Operations → Email Settings → Domains → See DNS
3. Confirm your SPF record references the Production domain (not the current IP address)

Hyperforce IP Allowlist by Region

Add all of the following IP addresses to the firewall allowlists of every third-party integration. All five regions must be allowlisted regardless of your primary Hyperforce region — Salesforce may route traffic from an alternate region during failover events. https://help.salesforce.com/s/articleView?id=002888834&type=1

Move Timeline (Performed by Salesforce)

The realm move is performed by the Salesforce Support and Operations teams during a planned maintenance window. You do not need to take any actions during the move itself — your role is to monitor the support case and verify the environment after the move completes.

During the move: All PIG instances (Production, Staging, Development) and storefronts are offline. Scheduled jobs will not run. Reschedule any data or code replications that fall within the move window (9 PM ET the day prior to 7 AM ET the day of the move). Replications running during the move result in failed jobs that require manual clearing. https://help.salesforce.com/s/articleView?id=002888834&type=1

Post-Move Verification Checklist

After Salesforce confirms the move is complete, verify the following before declaring the migration successful:

If any verification step fails, update the support case immediately — the Salesforce team on duty monitors the ticket throughout the move window under Global Handover / Follow the Sun coverage. https://help.salesforce.com/s/articleView?id=002888834&type=1