A freshly provisioned Windows Server with IIS can serve pages within minutes of first login, but the default configuration is tuned for convenience, not exposure. If the box is reachable from the public internet, work through this checklist before pointing a real domain at it. Everything below uses built-in IIS features or one free Microsoft module, so you do not need a third-party WAF to get a defensible baseline.<\/p>\n
Every enabled IIS module is a potential attack surface. The most common offender is WebDAV, which is off by default on modern installs but easy to enable accidentally and frequently abused to upload web shells. In Server Manager, remove WebDAV Publishing<\/strong>, and drop CGI<\/strong>, ASP<\/strong> and Server Side Includes<\/strong> unless a legacy app needs them:<\/p>\n Then confirm what remains with Request Filtering is built into IIS 7 and later, and it is your first line of defense against path traversal, oversized requests and dangerous extensions. Start with sane limits and deny the file types that should never be served:<\/p>\n Out of the box IIS announces itself with Removing the Disable TLS 1.0 and 1.1 at the Schannel level so no application can silently fall back:<\/p>\n Then require SSL on the site binding and add a URL Rewrite rule that permanently redirects port 80 to HTTPS (a 301 from IIS 8 and later ship with IP and Domain Restrictions built in. Static deny lists stop known bad ranges, but the dynamic restrictions are what save you from credential-stuffing floods. Set aggressive but survivable limits:<\/p>\n An IP that exceeds 20 requests in 60 seconds gets a 403 for the configured window. Tune the numbers against real traffic before launch; login endpoints and APIs will need higher ceilings than static pages.<\/p>\n Delete the Default Web Site or repoint it at a placeholder page, then give every real site its own host header. When hosting multiple HTTPS sites on one IP, use SNI rather than a wildcard certificate with a shared binding. Disable directory browsing explicitly ( Give each site its own application pool with the built-in Avoid granting Stack traces and file paths in HTTP responses are a gift to attackers. For .NET Framework apps set W3C logging should include the fields that make incident response possible: client IP, method, URI, status, and crucially The Remove-WindowsFeature Web-DAV-Publishing, Web-CGI, Web-ASP, Web-Includes<\/code><\/pre>\nGet-WindowsFeature Web-Server | Select-Object -ExpandProperty SubFeatures<\/code>.<\/p>\n2. Tighten Request Filtering<\/h2>\n
appcmd set config \/section:requestFiltering \/requestLimits.maxUrl:4096 \/requestLimits.maxQueryString:2048\nappcmd set config \/section:requestFiltering \/+fileExtensions.denyExtensions.[extension='.config',allowed='false']\nappcmd set config \/section:requestFiltering \/+fileExtensions.denyExtensions.[extension='.cs',allowed='false']\nappcmd set config \/section:requestFiltering \/+fileExtensions.denyExtensions.[extension='.bak',allowed='false']\nappcmd set config \/section:requestFiltering \/+hiddenSegments.[segment='App_Data']\nappcmd set config \/section:requestFiltering \/+verbs.[verb='TRACE',allowed='false']<\/code><\/pre>\nweb.config<\/code> and bin<\/code> are hidden segments by default; add App_Data<\/code> and any folder that holds backups. Blocking the TRACE<\/code> verb closes a cross-site tracing (XST) vector that scanners probe for constantly.<\/p>\n3. Strip and replace HTTP headers<\/h2>\n
X-Powered-By: ASP.NET<\/code> and a Server<\/code> header. Remove the first from web.config and add the security headers that cost nothing:<\/p>\n<configuration>\n <system.web>\n <httpRuntime enableVersionHeader="false" \/>\n <\/system.web>\n <system.webServer>\n <httpProtocol>\n <customHeaders>\n <remove name="X-Powered-By" \/>\n <add name="X-Content-Type-Options" value="nosniff" \/>\n <add name="X-Frame-Options" value="SAMEORIGIN" \/>\n <add name="Referrer-Policy" value="strict-origin-when-cross-origin" \/>\n <\/customHeaders>\n <\/httpProtocol>\n <\/system.webServer>\n<\/configuration><\/code><\/pre>\nServer<\/code> header requires an outbound URL Rewrite rule; if you already have the URL Rewrite module installed, add a rule that matches Server<\/code> in the RESPONSE_SERVER<\/code> server variable and sets it to an empty value.<\/p>\n4. Force TLS 1.2+ and redirect HTTP to HTTPS<\/h2>\n
foreach ($p in "TLS 1.0","TLS 1.1") {\n New-Item "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\$p\\Server" -Force | Out-Null\n New-ItemProperty "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\$p\\Server" `\n -Name Enabled -Value 0 -PropertyType DWord -Force | Out-Null\n New-ItemProperty "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\$p\\Server" `\n -Name DisabledByDefault -Value 1 -PropertyType DWord -Force | Out-Null\n}\nRestart-Service W3SVC -Force<\/code><\/pre>\nhttp:\/\/host\/<\/code> to https:\/\/host\/<\/code> with logRewrittenUrl<\/code> disabled).<\/p>\n5. Enable IP and Domain Restrictions with dynamic blocking<\/h2>\n
appcmd set config \/section:ipSecurity \/enableDynamicIpRestriction:true `\n \/dynamicIpRestriction.maxConcurrentRequests:10 `\n \/dynamicIpRestriction.maxRequestsPerTimeInterval:20 `\n \/dynamicIpRestriction.timePeriod:00:01:00 `\n \/dynamicIpRestriction.denyAction:Forbidden<\/code><\/pre>\n6. Clean up bindings and the default site<\/h2>\n
directoryBrowse<\/code> should be false<\/code>) and drop the HTTP binding entirely if the redirect rule handles port 80.<\/p>\n7. Least-privilege app pool identities<\/h2>\n
ApplicationPoolIdentity<\/code>, leave Load User Profile<\/strong> off, and grant the pool identity only the ACLs it needs:<\/p>\nicacls "D:\\wwwroot\\contoso" \/grant "IIS APPPOOL\\contoso:(OI)(CI)(RX)"<\/code><\/pre>\nIIS_IUSRS<\/code> write access to web roots: it covers every pool on the server, so one compromised site becomes a pivot into all of them.<\/p>\n8. Turn off detailed errors<\/h2>\n
<customErrors mode=\"On\" \/><\/code>; for ASP.NET Core set ASPNETCORE_ENVIRONMENT=Production<\/code> and stdoutLogEnabled=\"false\"<\/code>. At the IIS level, set <httpErrors errorMode=\"Custom\" \/><\/code> and serve a generic 404 and 500 page.<\/p>\n9. Log what matters, rotate it, watch it<\/h2>\n
TimeTaken<\/code>. Rotate logs daily or by size, and treat a burst of 404s from one IP as a scan in progress – that is exactly what the dynamic IP restriction in step 5 is for.<\/p>\n10. Back up the configuration before and after<\/h2>\n
appcmd add backup "PreHardening"\n# verify:\nappcmd list backups<\/code><\/pre>\napplicationHost.config<\/code> backup takes seconds and gives you a clean rollback point when a hardening change breaks an app.<\/p>\n