{"id":712,"date":"2026-08-30T23:12:27","date_gmt":"2026-08-30T23:12:27","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=712"},"modified":"2026-09-08T22:23:27","modified_gmt":"2026-09-08T22:23:27","slug":"running-iis-windows-server-beginners-guide","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/running-iis-windows-server-beginners-guide\/","title":{"rendered":"IIS Hardening for Production: Security Headers, Request Filtering, and App Pool Isolation"},"content":{"rendered":"\n

Running IIS in production means more than putting files in C:\\inetpub\\wwwroot and opening port 80. A default IIS installation is built for developer convenience, not security. Before you serve a single request to the public, you need to lock down the server, isolate applications, and configure the right security headers. This guide covers the production-hardening steps that every Windows admin should apply. If you are still choosing a provider, our Windows VPS comparison table<\/a> shows which hosts support the full IIS feature set.<\/p>\n\n\n\n

Step 1: Remove Unnecessary IIS Modules<\/h2>\n\n\n\n

IIS ships with dozens of modules enabled by default. Each module is a potential attack surface. Remove what you do not need:<\/p>\n\n\n\n

# Remove modules that are not needed in production\nDisable-WindowsOptionalFeature -Online -FeatureName IIS-WebDAV\nDisable-WindowsOptionalFeature -Online -FeatureName IIS-FTPServer\nDisable-WindowsOptionalFeature -Online -FeatureName IIS-CertProvider\nDisable-WindowsOptionalFeature -Online -FeatureName IIS-IPSecurity<\/code><\/pre>\n\n\n\n
At minimum, keep: StaticFileModule, DefaultDocumentModule, DirectoryListingModule, AnonymousAuthModule, RequestFilteringModule, and (if using ASP.NET) AspNetModule. Everything else should be evaluated.<\/p>\n\n\n\n
Step 2: Configure Request Filtering<\/h2>\n\n\n\n
Request Filtering blocks malicious requests before they reach your application. Configure it in web.config or via IIS Manager:<\/p>\n\n\n\n
<configuration>\n  <system.webServer>\n    <security>\n      <requestFiltering>\n        <fileExtensions allowUnlisted=\"false\">\n          <add fileExtension=\".aspx\" allowed=\"true\" \/>\n          <add fileExtension=\".html\" allowed=\"true\" \/>\n          <add fileExtension=\".css\" allowed=\"true\" \/>\n          <add fileExtension=\".js\" allowed=\"true\" \/>\n        <\/fileExtensions>\n        <requestLimits maxUrl=\"4096\" maxQueryString=\"2048\" \/>\n        <verbs allowUnlisted=\"false\">\n          <add verb=\"GET\" allowed=\"true\" \/>\n          <add verb=\"POST\" allowed=\"true\" \/>\n          <add verb=\"HEAD\" allowed=\"true\" \/>\n        <\/verbs>\n        <hiddenSegments>\n          <add segment=\"bin\" \/>\n          <add segment=\"App_Code\" \/>\n          <add segment=\"App_Data\" \/>\n        <\/hiddenSegments>\n      <\/requestFiltering>\n    <\/security>\n  <\/system.webServer>\n<\/configuration><\/code><\/pre>\n\n\n\n
Step 3: Security Headers via URL Rewrite<\/h2>\n\n\n\n
Add the following outbound rewrite rules to send security headers with every response:<\/p>\n\n\n\n
<rewrite>\n  <outboundRules>\n    <rule name=\"Strict-Transport-Security\">\n      <match serverVariable=\"RESPONSE_Strict_Transport_Security\" pattern=\".*\" \/>\n      <action type=\"Rewrite\" value=\"max-age=31536000; includeSubDomains\" \/>\n    <\/rule>\n    <rule name=\"X-Frame-Options\">\n      <match serverVariable=\"RESPONSE_X-Frame-Options\" pattern=\".*\" \/>\n      <action type=\"Rewrite\" value=\"SAMEORIGIN\" \/>\n    <\/rule>\n    <rule name=\"X-Content-Type-Options\">\n      <match serverVariable=\"RESPONSE_X-Content-Type-Options\" pattern=\".*\" \/>\n      <action type=\"Rewrite\" value=\"nosniff\" \/>\n    <\/rule>\n    <rule name=\"Referrer-Policy\">\n      <match serverVariable=\"RESPONSE_Referrer-Policy\" pattern=\".*\" \/>\n      <action type=\"Rewrite\" value=\"strict-origin-when-cross-origin\" \/>\n    <\/rule>\n  <\/outboundRules>\n<\/rewrite><\/code><\/pre>\n\n\n\n
Step 4: Application Pool Isolation<\/h2>\n\n\n\n
Each site or application should run in its own application pool. If one pool crashes or is compromised, the others keep running. Configure each pool with:<\/p>\n\n