IIS (Internet Information Services) Administration & Hardening Guides
Welcome to the definitive hub for IIS (Internet Information Services) administration, security hardening, and optimization on saotn.org. Managing production web servers on Windows Server requires a deep understanding of application pools, request routing, and web security protocols.
Whether you are configuring high-performance web applications, setting up robust URL rewrite architectures, or hardening enterprise environments against modern security vulnerabilities, these step-by-step guides provide the production-ready configurations and troubleshooting steps you need.
Core IIS Management Topics
To help you navigate our technical resources, the most critical IIS documentation is organized by administrative focus:
Security Hardening & Headers: Protect your web infrastructure from information leakage and transport-layer attacks. Master essential hardening techniques such as how to remove the IIS Server version HTTP Response Header and implementing enterprise-grade security by enabling HTTP Strict-Transport-Security (HSTS) on IIS.
URL Rewrite & Traffic Routing: Take complete control over inbound HTTP/HTTPS traffic. Learn the nuances of site migrations and pattern matching with practical, clean IIS URL Rewrite configuration examples.
Application Pool Optimization: Maintain zero-downtime environments and efficient resource utilization. Streamline your automation workflow by discovering how to set IIS application pool recycle defaults to specific times instead of volatile fixed intervals.
Automation & Provisioning: Scale your web nodes without touching the GUI. Leverage the power of automation to dynamically deploy environments, including quick guides on how to install IIS in Windows 11 using PowerShell.
Browse the comprehensive, chronological feed below for deeper insights into IIS backup and restore procedures, custom module configurations, and expert-level web server troubleshooting.
Windows Server
Last updated:
Users can install and run multiple .NET Framework versions on their computers. When you develop or deploy your app, you might need to know which .NET versions are installed on a machine and here is how to check the .NET version.
Windows Server
Last updated:
WSUSPool keeps stopping? Sometimes you find your WSUS server keeps crashing over and over again. The WSUS application pool periodically stops, WSUS is unavailable and/or the WSUS management console hangs.
Windows Server
Last updated:
In this post I address four (4) important actionable security measures for your servers running Windows Server (AD DS, DFS, IIS) and RDP.
Windows Server
Last updated:
Windows Server 2016 was released last week, meaning we can finally lift the idiotic 260 characters limitation for NTFS paths. For this, you use a GPO or Group Policy Object in Windows Server.
WordPress
Last updated:
Gzip compress and serve WP-Super-Cache or Cache Enabler static HTML files, to supercharge your WordPress blog!
Windows Server
Last updated:
In this post I provide you with 5 ways to cleanup files and free up disk space in Windows Server 2016 (and older / newer Windows Server version), without using the Disk Cleanup Utility. Reclaim lots of lost gigabytes easy. Disk space usage is still an issue in Windows Server.
WordPress
Last updated:
Move WordPress to HTTPS correctly. Learn the Site Health switch, database search and replace, IIS/Apache redirects, HSTS hardening, and OpenSSL verification.
Windows Server
Last updated:
When you start to play with Windows Server 2016 and IIS 10, you’ll get an error when you try to install the IIS URL Rewrite Module in IIS. The error occurs because the URL Rewrite Module installer contains an invalid version check for the IIS being used. Here is how to install IIS URL Rewrite Module 2 in IIS 10…
Windows Server
Last updated:
The AppCmd.exe command is your one-stop-shop for administering Windows Server IIS web servers. In combination with WinRM it is your Swiss Army knife for your daily routine. This post introduces appcmd and provides you with a lot of helpful appcmd examples.
Codebase
Last updated:
Get the current number of active FTP client connections on your Windows Server IIS FTP Service using the Get-Counter cmdlet and the Microsoft FTP Service Current NonAnonymous Users performance counter.
Windows Server
Last updated:
Learn to protect your WordPress website with this web.config file on Windows Server IIS. Block IP addresses, bad bots, query string sequences
Windows Server
Last updated:
Fix for IIS URL Rewrite Module error “Rewrite Module error: Expression contains a repeat expression”
Windows Server
Last updated:
Using Windows Server File Server Resource Manager‘s File Screens you can block vulnerable WordPress plugins from being uploaded to your IIS web server. In the following example, you’ll learn how to block WP DB Backup plugin system-wide on Windows Server, read on…
Windows Server
Last updated:
Learn to block Baidu spider (BaiduSpider user agent) properly, because it is a real pain to block. Especially since Baidu does not respect `robots.txt` as it should. This post shows you how to block Baidu Spider bot, using IIS URL Rewrite Module based on its User-Agent string.
WordPress
Last updated:
A web.config file for WordPress on Windows Server IIS. Are you having trouble with your web.config? Here is mine 🙂
Windows Server
Last updated:
Set up HTTP Strict-Transport-Security (HSTS) response header in Windows Server IIS 10, here is some more technical information about HSTS in IIS, and other security headers…
Windows Server
Last updated:
By default, an IIS application pool (or “AppPool”) recycles on a regular time interval of 1740 minutes, or 29 hours. One reason for this time interval is that application pools don’t recycle at the same moment every day (every day at 07.00 for example).
Web applications
Last updated:
Learn how to optimize PHP performance by checking and setting PHP realpath_cache_size. The realpath_cache_size size represents the total number of bytes in the path strings stored, plus the size of the data associated with the cache entry
Windows Server
Last updated:
In this article you’ll learn how to start all stopped application pools that have the ApplicationPool.AutoStart property set to $True using AppCmd.exe or PowerShell. This is something you often or occasionally have to perform on various servers, for example when an application pool hangs.
Web applications
Last updated:
Outdated but fun: PHP 7 with OPcache in IIS Express for Microsoft WebMatrix 3: create your DevOps with Microsoft WebMatrix and IIS Express