IIS (Internet Information Services) Administration & Hardening Guides
Welcome to the definitive hub for IIS (Internet Information Services) administration, security hardening, and optimization on saotn.org. Managing production web servers on Windows Server requires a deep understanding of application pools, request routing, and web security protocols.
Whether you are configuring high-performance web applications, setting up robust URL rewrite architectures, or hardening enterprise environments against modern security vulnerabilities, these step-by-step guides provide the production-ready configurations and troubleshooting steps you need.
Core IIS Management Topics
To help you navigate our technical resources, the most critical IIS documentation is organized by administrative focus:
Security Hardening & Headers: Protect your web infrastructure from information leakage and transport-layer attacks. Master essential hardening techniques such as how to remove the IIS Server version HTTP Response Header and implementing enterprise-grade security by enabling HTTP Strict-Transport-Security (HSTS) on IIS.
URL Rewrite & Traffic Routing: Take complete control over inbound HTTP/HTTPS traffic. Learn the nuances of site migrations and pattern matching with practical, clean IIS URL Rewrite configuration examples.
Application Pool Optimization: Maintain zero-downtime environments and efficient resource utilization. Streamline your automation workflow by discovering how to set IIS application pool recycle defaults to specific times instead of volatile fixed intervals.
Automation & Provisioning: Scale your web nodes without touching the GUI. Leverage the power of automation to dynamically deploy environments, including quick guides on how to install IIS in Windows 11 using PowerShell.
Browse the comprehensive, chronological feed below for deeper insights into IIS backup and restore procedures, custom module configurations, and expert-level web server troubleshooting.
Windows Server
Last updated:
Windows Server IIS loves to tell the world that a website runs on IIS. It does so with the “Server:” header in the HTTP response, as shown below. In this post I’ll show you how to remove HTTP response headers in Windows Server IIS. You don’t want to give hackers too much information about your servers, right?.
Windows Server
Last updated:
When the .svc web service handler doesn’t work in IIS with ASP.NET 4.5 and returns a 404 Not Found error, you may need to add an extra handler to IIS. Read on…
Web applications
Last updated:
Ghost Publishing platform uses Nodemailer to send email with Node.js. It can send email using SMTP, sendmail or Amazon SES and is unicode friendly.
Windows Server
Last updated:
Learn how to enable WebSocket protocol support in IIS and ASP.NET 4.8 on Windows Server. Step-by-step PowerShell guide for quick installation.
Windows Server
Last updated:
Sometimes it’s important to remove (or hide) the file extension of scripts you use. Security by obscurity might be that reason, if you don’t want others to know what script language you are using for your website, or for static site hosts.
Windows Server
Last updated:
Gzip compression conflicts with IIS Outbound Rules resulting in HTTP 500.52 URL Rewrite Module Error. Here is how to resolve this.
Windows Server
Last updated:
On IIS, Contact Form 7 captcha has one HUGE disadvantage: temporary captcha files placed in wp-content/uploads/wpcf7_captcha, are not automatically removed. Here is how to remove Contact Form 7 temporary captcha files on IIS…
Umbraco
Last updated:
Configure Umbraco for SQLServer sessionState storage and prepare Umbraco for high performance web garden or web farm, and load balancing environments. This post explains it all.
Windows Server
Last updated:
Address both x86 and x64 versions of .NET with AppCmd. When administering an IIS web server you frequently have to use AppCmd.exe to make configuration changes. Whether it is for a specific web site or server wide. Some think AppCmd is very limited, but here is how you can target multiple ASP.NET versions with AppCmd!
Codebase
Last updated:
MySql.Data.MySqlClient ASP.NET test script
Codebase
Last updated:
How to use PowerShell to add websites and application pools in IIS
Windows Server
Last updated:
Use IIS Outbound Rules and URL Rewrite Module to create a custom created Content Delivery Network (CDN) for static content ofloading and speed-up your website.
Web applications
Last updated:
Fix “System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.” in ASP.NET on IIS
Windows Server
Last updated:
How to use GnuWin32 ported tools like grep.exe and find.exe for forensic log file analysis in Windows Server. Find webshells and backdoors in websites, check visitor’s IP addresses or hits to backdoor/webshell files in IIS log files easy. Command-line log analysis in Windows Server, search for Joomla-, WordPress-, Drupal- and PHP- malware & backdoors in your website with grep and find.
Useful
Last updated:
In this post I provide you various HTTP to HTTPS redirection methods, for Windows Server IIS and Linux Apache. Use these examples to your advantage to secure the traffic between your visitors and your website.
Web applications
Last updated:
How to let MySQL Connector/NET and Entity Framework play nicely. This blog post is a quicky and an oldy… Since we still receive a reasonable amount of questions about this topic at the customer service of my employer I’m posting this here, with some commonly made mistakes and points of attention.
Windows Server
Last updated:
Somewhere in my archives, I found this VBScript for stopping, starting and recycling an IIS 6.0 application pool. It doesn’t use adsutil.vbs. It might come in handy, because it’s always very time consuming to start the Computer Management console, click through Services and Applications > Internet Information Services (IIS) Manager > Application Pools to find the Application Pool you want to start, stop or recycle.
Windows Server
Last updated:
This post describes some of the IIS URL Rewrite Module web.config equivalents of commonly used Apache .htaccess settings. You’ll learn how to translate .htaccess content to IIS web.config, this is useful when you need to migrate your website from Apache to Windows Server IIS.
Windows Server
Last updated:
In this article you’ll learn how to install and set up PHP with the Windows Cache Extension (WinCache) on windows IIS web servers. WinCache enabled PHP gives a great PHP performance boost for your WordPress-, Drupal or Joomla website. This post will show you it’s not hard to set up high performance PHP hosting on IIS.
Windows Server
Last updated:
Removing ETag response headers is not an easy task in Windows Server IIS web servers. Here I show you how to properly remove ETag HTTP response headers with an IIS Rewrite Module Outbound rewrite rule.