[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [IIS Security: How to Harden a Windows IIS Web Server in 10 Steps](/blog/10-steps-for-improving-iis-security) Publish date January 5, 2025 {x} minute read # IIS Security: How to Harden a Windows IIS Web Server in 10 Steps [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Microsoft Internet Information Server (IIS) is widely used in the enterprise, despite a less-than-stellar reputation for security. In fact, for many “IIS security” is a contradiction of terms—though in all fairness, Microsoft's web server solution has improved *significantly* over the years.  IIS 8.5 for server 2012 R2 and IIS 10 for 2016 have been hardened and no longer present the dangerous default configurations of older IIS iterations, but can still be further tightened. By following these 10 steps, you can greatly increase security for your IIS web apps and servers. ## 1. Analyze Dependencies and Uninstall Unneeded IIS Modules After Upgrading. If you plan on upgrading from a previous version of IIS, be forewarned that your previous installation’s state information and metabase will be carried over to the new install. Be sure to disable and/or uninstall any unused IIS components and features to minimize the web server’s [attack surface](/blog/attack-surface). Even if you haven't upgraded, ensure that only required modules are present. UpGuard ensures IIS modules are correct across any number of servers by transforming a known good configuration on one of the servers into executable documentation against which the others can be tested regularly. ## 2. Properly Configure Web Server User/Group Accounts IIS features built-in user and group accounts dedicated to the web server. So for example, separate system and application administrator accounts can be created for more [granular-level access](https://www.upguard.com/blog/rbac). System administrators can therefore give application administrators the rights to make application-level configuration changes without the need to grant them administrative access to the server. These accounts should be audited on a ongoing basis to ensure they are configured securely. UpGuard tracks and visualizes which users are running which services, and tests servers against your standards to surface any user configurations that could be potential security problems. Oops, looks like this one is running as Local System, a highly privileged account: ## 3. Use IIS 7’s CGI/ISAPI Restrictions CGI and ISAPI are two common ways to build upon IIS—either for generating dynamic content or for extending IIS’ native capabilities. Unfortunately, CGI files (.exe) and ISAPI extensions (.dll) are also commonly exploited in web attacks and should be restricted if not in use. For example, if you’re using PHP or ColdFusion to create dynamic content with IIS, use of CGI and other ISAPI extensions may not be needed. Like IIS modules, these configurations should be uninstalled unless they are being specifically used. UpGuard handles IIS modules and configurations the same way, allowing you to quickly diff a set of IIS servers and see which modules are installed correctly. Use policies to keep IIS modules consistent over time by immediately surfacing any changes that violate your expected configurations. ## 4. Configure HTTP Request Filtering Options UrlScan was an extension that functioned as a security tool for restricting HTTP requests. UrlScan functionality is now built right into IIS, and should be configured appropriately. Potentially harmful HTTP requests are prevented from reaching the server through rule-based filtering. These options are critical for mitigating threats like SQL injections, among others, and should be used in conjunction with your IIS-based web application. UpGuard finds out which of your servers have the request filtering module installed and verifies that it's configured properly. No more guesswork about whether IIS servers between production and development are the same. ## 5. Use Dynamic IP Restrictions Dynamic IP address restrictions use a requestor’s IP addresses and domain name to determine whether or not to restrict access. This is essentially a whitelist—"allowUnlisted"—that IIS uses to prevent unauthorized access. So in the event of [Denial of Service (DoS)](https://www.upguard.com/blog/what-is-a-ddos-attack) and [brute force attacks](/blog/brute-force-attack), IIS’ Dynamic IP Restrictions (DIPR) module can temporarily block IP addresses making unusual requests. Dynamic IPs are just another module within IIS. UpGuard helps you keep track of where it's installed and can proactively notify you if it's changed. If a production server is deployed without this module, web requests become a serious [vector for attack](/blog/attack-vector), depending on what kind of code you have out there.  ## 6. Incorporate URL Authorization In Your Application URL authorization grants access to URLs within an IIS application based on user names and roles, as opposed to server or system accounts. This makes it easier to restrict content based on group membership. URL authorization rules can be associated with a server, site, or application. Group membership is another important aspect of the system state that UpGuard manages. For example, if you wanted to monitor your administrators group, UpGuard could alert you when a new user was added, or an expected user removed.  ## 7. Use Encrypted Forms-Based Authentication Forms-based authentication allows for the management of client registration and authentication at the application level, as opposed to on the Windows account level. Because this authentication mechanism passes form values as clear text, [SSL](/blog/ssl-certificate) must be installed to [encrypt](/blog/encryption) sensitive data. IIS treats authentication mechanisms as features, so tracking them with UpGuard is easy. Make sure that only the auth mechanisms you're using are installed, and make sure they're installed everywhere with just a few clicks. ## 8. Use Application Pool Identities This feature of IIS enables more granular security by running application pools under unique accounts, bypassing domain or local account creation/management. By using a low-privileged account—namely, ApplicationPoolIdentity—multiple distinct sets of anonymous website content can be isolated without having to create a unique account for each website. This is a key operation, as an exploited web application will only have the rights the user running the application pool has, so limiting and segregating that can drastically reduce damage.  ## 9. Isolate/Segregate Web Applications By using a combination of the above IIS features, you can achieve more secure isolation and segregation for your web applications. In general, the following security recommendations should be taken into consideration: * Each application pool should be assigned to a single website. * The application pool should be assigned to a dedicated user. * Anonymous user identities should be set up to use the application pool. ## 10. Fix Critical IIS Vulnerabilities Last but not least, critical IIS [vulnerabilities](/blog/vulnerability) should be patched or remediated. Like any Microsoft updates, staying on top of patches and service packs helps ensure that your server is as protected as possible. Most exploits target vulnerabilities that are over a year old and have patches released, so a little regular maintenance goes a long way. Patches should first be deployed in a test environment before production, and each update should be considered and approved if possible before being authorized in the organization. UpGuard helps ensure that patch levels are the same across your IIS servers. By building an UpGuard policy from a server with a proper patch level, other servers can be compared against it to find any outliers. Remediation can then be tracked as servers become compliant within UpGuard. ## Wrap-up In short, the modular nature of IIS allows for more granular control over web server resources and security. However, this can either make your web applications more or less secure—depending on the person or group responsible for security. Deeper, fine-grained security mechanisms require more careful management of said resources; fortunately, these arduous processes can be managed automatically with UpGuard's platform for vulnerability detected and monitoring. Our Windows and IIS security policies can automatically scan your environment for critical vulnerabilities and security gaps.  ## Are You at Risk of a Data Breach? UpGuard can continuously monitor both the internal and third-party attack surface to help organizations discover and remediate residual risks exposing their [sensitive data](https://www.upguard.com/blog/sensitive-data). UpGuard also supports compliance across a myriad of security frameworks, including the new requirements set by [Biden's Cybersecurity Executive Order](https://www.upguard.com/blog/cybersecurity-executive-order). [Click here for a FREE trial of UpGuard today!](https://www.upguard.com/demo) eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)