IIS (Internet Information Services) Administration & Hardening Guides
Welcome to the definitive hub for IIS (Internet Information Services) administration, security hardening, and optimization on saotn.org. Managing production web servers on Windows Server requires a deep understanding of application pools, request routing, and web security protocols.
Whether you are configuring high-performance web applications, setting up robust URL rewrite architectures, or hardening enterprise environments against modern security vulnerabilities, these step-by-step guides provide the production-ready configurations and troubleshooting steps you need.
Core IIS Management Topics
To help you navigate our technical resources, the most critical IIS documentation is organized by administrative focus:
Browse the comprehensive, chronological feed below for deeper insights into IIS backup and restore procedures, custom module configurations, and expert-level web server troubleshooting.
Windows Server
Last updated:
By default, an IIS application pool (or "AppPool") recycles on a regular time interval of 1740 minutes, or 29 hours. One reason for this time interval is that application pools don't recycle at the same moment every day (every day at 07.00 for example).
Security
Last updated:
Joomla websites with the vulnerable Googlemaps plugin are abused as open proxy for DoS attacks. Here is how to block plugin_googlemap2_proxy.php.
Web applications
Last updated:
How to set up a global Geolocation DNS load balancing Varnish Cache Content Delivery Network with Bind9, geo-ip database, Varnish Cache and DigtalOcean. DIY High-Availability for your website!
Web applications
Last updated:
Learn how to optimize PHP performance by checking and setting PHP realpath_cache_size. The realpath_cache_size size represents the total number of bytes in the path strings stored, plus the size of the data associated with the cache entry
Windows Server
Last updated:
In this article you'll learn how to start all stopped application pools that have the ApplicationPool.AutoStart property set to $True using AppCmd.exe or PowerShell. This is something you often or occasionally have to perform on various servers, for example when an application pool hangs.
Web applications
Last updated:
Outdated but fun: PHP 7 with OPcache in IIS Express for Microsoft WebMatrix 3: create your DevOps with Microsoft WebMatrix and IIS Express
Windows Server
Last updated:
A Magento maintenance script for Windows Server and IIS: clear Magento's MySQL log tables and var cache directories on a schedule for a faster webshop.
Windows Server
Last updated:
Website DDoS protection with mod_evasive on Windows Server IIS, using Helicon Ape: how to configure it, exclude websites, and where it falls short.
Windows Server
Last updated:
Windows Server IIS loves to tell the world that a website runs on IIS. It does so with the "Server:" header in the HTTP response, as shown below. In this post I'll show you how to remove HTTP response headers in Windows Server IIS. You don't want to give hackers too much information about your servers, right?.
Windows Server
Last updated:
When the .svc web service handler doesn't work in IIS with ASP.NET 4.5 and returns a 404 Not Found error, you may need to add an extra handler to IIS. Read on...
Web applications
Last updated:
Ghost Publishing platform uses Nodemailer to send email with Node.js. It can send email using SMTP, sendmail or Amazon SES and is unicode friendly.
WordPress
Last updated:
I wanted to migrate from WordPress to Ghost, and at first failed. Here's the write-up: exporting WordPress to JSON and fixing Ghost's import errors.
Windows Server
Last updated:
Learn how to enable WebSocket protocol support in IIS and ASP.NET 4.8 on Windows Server. Step-by-step PowerShell guide for quick installation.
Windows Server
Last updated:
Sometimes it's important to remove (or hide) the file extension of scripts you use. Security by obscurity might be that reason, if you don't want others to know what script language you are using for your website, or for static site hosts.
Windows Server
Last updated:
Gzip compression conflicts with IIS Outbound Rules resulting in HTTP 500.52 URL Rewrite Module Error. Here is how to resolve this.
Windows Server
Last updated:
On IIS, Contact Form 7 captcha has one HUGE disadvantage: temporary captcha files placed in wp-content/uploads/wpcf7_captcha, are not automatically removed. Here is how to remove Contact Form 7 temporary captcha files on IIS…
Umbraco
Last updated:
Configure Umbraco for SQLServer sessionState storage and prepare Umbraco for high performance web garden or web farm, and load balancing environments. This post explains it all.
Windows Server
Last updated:
How to install Node.js, the iisnode module and the Ghost publishing platform on Windows Server IIS, including web.config and troubleshooting.
Windows Server
Last updated:
Address both x86 and x64 versions of .NET with AppCmd. When administering an IIS web server you frequently have to use AppCmd.exe to make configuration changes. Whether it is for a specific web site or server wide. Some think AppCmd is very limited, but here is how you can target multiple ASP.NET versions with AppCmd!
Codebase
Last updated:
MySql.Data.MySqlClient ASP.NET test script