IIS Hardening for Production: Security Headers, Request Filtering, and App Pool Isolation

Running IIS in production means more than putting files in C:\inetpub\wwwroot and opening port 80. A default IIS installation is built for developer convenience, not security. Before you serve a single request to the public, you need to lock down the server, isolate applications, and configure the right security headers. This guide covers the production-hardening steps that every Windows admin should apply. If you are still choosing a provider, our Windows VPS comparison table shows which hosts support the full IIS feature set.

Step 1: Remove Unnecessary IIS Modules

IIS ships with dozens of modules enabled by default. Each module is a potential attack surface. Remove what you do not need:

# Remove modules that are not needed in production
Disable-WindowsOptionalFeature -Online -FeatureName IIS-WebDAV
Disable-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer
Disable-WindowsOptionalFeature -Online -FeatureName IIS-CertProvider
Disable-WindowsOptionalFeature -Online -FeatureName IIS-IPSecurity

At minimum, keep: StaticFileModule, DefaultDocumentModule, DirectoryListingModule, AnonymousAuthModule, RequestFilteringModule, and (if using ASP.NET) AspNetModule. Everything else should be evaluated.

Step 2: Configure Request Filtering

Request Filtering blocks malicious requests before they reach your application. Configure it in web.config or via IIS Manager:

<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <fileExtensions allowUnlisted="false">
          <add fileExtension=".aspx" allowed="true" />
          <add fileExtension=".html" allowed="true" />
          <add fileExtension=".css" allowed="true" />
          <add fileExtension=".js" allowed="true" />
        </fileExtensions>
        <requestLimits maxUrl="4096" maxQueryString="2048" />
        <verbs allowUnlisted="false">
          <add verb="GET" allowed="true" />
          <add verb="POST" allowed="true" />
          <add verb="HEAD" allowed="true" />
        </verbs>
        <hiddenSegments>
          <add segment="bin" />
          <add segment="App_Code" />
          <add segment="App_Data" />
        </hiddenSegments>
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

Step 3: Security Headers via URL Rewrite

Add the following outbound rewrite rules to send security headers with every response:

<rewrite>
  <outboundRules>
    <rule name="Strict-Transport-Security">
      <match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
      <action type="Rewrite" value="max-age=31536000; includeSubDomains" />
    </rule>
    <rule name="X-Frame-Options">
      <match serverVariable="RESPONSE_X-Frame-Options" pattern=".*" />
      <action type="Rewrite" value="SAMEORIGIN" />
    </rule>
    <rule name="X-Content-Type-Options">
      <match serverVariable="RESPONSE_X-Content-Type-Options" pattern=".*" />
      <action type="Rewrite" value="nosniff" />
    </rule>
    <rule name="Referrer-Policy">
      <match serverVariable="RESPONSE_Referrer-Policy" pattern=".*" />
      <action type="Rewrite" value="strict-origin-when-cross-origin" />
    </rule>
  </outboundRules>
</rewrite>

Step 4: Application Pool Isolation

Each site or application should run in its own application pool. If one pool crashes or is compromised, the others keep running. Configure each pool with:

• Identity: ApplicationPoolIdentity (not LocalSystem)
• Load User Profile: False (avoids profile bloat)
• Recycling: Regular time interval (e.g., 1740 minutes = 29 hours) + virtual memory limit
• Rapid-Fail Protection: Enabled with 5 failures in 5 minutes

Step 5: Enable Failed Request Tracing

Failed Request Tracing (FREB) captures detailed XML logs of failed requests. Enable it at the server level, then configure per-site tracing rules for 500-series errors. This is invaluable for debugging production issues without enabling verbose logging permanently.

For a complete provider comparison that includes IIS compatibility and Windows Server features, visit our main site.