{"id":6215,"date":"2019-07-26T11:27:18","date_gmt":"2019-07-26T11:27:18","guid":{"rendered":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/?p=6215"},"modified":"2019-07-26T11:27:18","modified_gmt":"2019-07-26T11:27:18","slug":"ways-to-secure-your-website-in-iis","status":"publish","type":"post","link":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/","title":{"rendered":"Ways to Secure Your Website in IIS"},"content":{"rendered":"

The most common root cause is poor file security or poor configuration selection in terms of the ways IIS should access the file content while investigating site infections or defacing on a Windows Servers. You can prevent this in an easiest way by simply starting a secure site.<\/p>\n

To setup a website in IIS is very easy but several default settings aren\u2019t best in terms of security or easy management.<\/p>\n

Also, there are some practices that were considered essential or standard but now aren\u2019t important or weren\u2019t necessary at first too. Therefore, we recommend that you follow these steps for setting up a website for ensuring that it is correctly and securely set up. Though you might find some of these setting or permission change changeable, they work for systems that host multiple domains or multiple tenants as they avoid any cross-site file access.<\/p>\n

Add the Site to IIS<\/h3>\n

For adding a website in IIS (Internet Information Services)<\/strong>, go to the IIS manager<\/strong>, right-click on Sites<\/strong>, and select Add Website<\/strong>.<\/p>\n

\"\"<\/a><\/p>\n

While adding a site to IIS<\/strong>, it is recommended to use the domain name as the \u201cSite name\u201d<\/strong> to identify easily.<\/p>\n

Under the \u201cPhysical path\u201d<\/strong>, mention the path where your website content is located or use \u201c\u2026\u201d<\/strong> to navigate and select the folder.<\/p>\n

Note that you don\u2019t need to modify configuration options under \u201cConnect as\u2026\u201d<\/strong> and \u201cTest Settings\u2026\u201d<\/strong>.<\/p>\n

While configuring site bindings, it is recommended to select a specific IP from the \u201cIP address\u201d<\/strong> drop-down. But this is considered to be an outdated practice typically in terms of how SSLs used to require dedicated IPs. This isn\u2019t necessary now and can actually lead to problems when getting into replication or highly available configuration.<\/p>\n

Therefore, it is best to leave IP addresses set to All Unassigned and enter the domain name that you want to host in the \u201cHost name\u201d<\/strong> field.<\/p>\n

Remember that you can enter only one value here. You can add additional host names after the site is created. For this, just right-click on the site and go to Bindings. Further, you can select \u201chttps\u201d<\/strong> instead of \u201chttp\u201d<\/strong> based on your needs.<\/p>\n

Set the Anonymous User<\/h3>\n

In technical terms, this is all you need to do for setting up a site in IIS. But the site may or may not work and the security settings on the site are not best. The next step while securing your site is to configure the IIS user that will access your files. For this, it is important to change the associated Anonymous user and make a few security changes on the content folder of the website.<\/p>\n

Select your new site on the left in the IIS. Then in the main window double click on Authentication, select Anonymous Authentication, and then click \u201cEdit\u2026\u201d<\/strong> on the right action bar.<\/p>\n

\"\"<\/a><\/p>\n

What is IUSR in IIS?<\/h3>\n

A new site in IIS utilizes the IUSR<\/strong> account by default for accessing files. This is a built-in shared account typically used by IIS for accessing the file content. This indicates that it will use the application pool\u2019s identity (user) for accessing file content.<\/p>\n

It doesn\u2019t matter if you leave this configured in case you want to host just a single domain. But for hosting multiple domains, this isn\u2019t secure as it would then be possible for any site that uses the same account to access files from another site. Therefore, as a standard practice it is recommended to switch away from using the IUSR account for sites, instead of selecting \u201cApplication pool identity\u201d<\/strong> and clicking OK<\/strong>.<\/p>\n

As an alternate option, you can manually create a user on the system for each site. But for an additional user- you need to manage the credentials, configure permissions for two users (the application pool user and the anonymous user) and possible complications with password difficulty and rotation needs that your server or organization may have.<\/p>\n

You don\u2019t need to configure anything further in IIS in terms of security but still go through the application pool settings quickly. For checking the settings on the application pool, in IIS, go to the left menu and select Application Pools<\/strong>, select the application pool for the site you created (typically the same name as the name of the site) and on the right action bar, click on \u201cAdvanced Settings\u2026\u201d<\/strong>.<\/p>\n

\"\"<\/a><\/p>\n

Here, the related setting is the identity and by default it is \u201cApplicationPoolIdentity\u201d<\/strong>. It means to access the file content, IIS and the associated application pool will use a hidden and dynamic user based off the name of the application pool to access files. This user can only be used by IIS, has no associate password and only has the access to files that are specifically granted to it. Hence, it eliminated the requirement of managing system users and credentials.<\/p>\n

Set Folder Permissions in IIS<\/h3>\n

As mentioned, the \u201cApplicationPoolIdentity\u201d<\/strong> user has very few permissions and so, the last steps is to make sure that the website files have been secured with the proper security settings. Go through your file system and search the folder where you plan on hosting your site\u2019s files. Then right-click on the folder and select Properties. Here, go to the Security<\/strong> tab.<\/p>\n

\"\"<\/a><\/p>\n

You will find several security permissions set up on the folder by default that aren\u2019t essential and are potentially insecure. For securing your website, it is recommended to remove all but the \u201cSYSTEM\u201d<\/strong> and \u201cAdministrators\u201d<\/strong> groups and add the \u201cApplicationPoolIdentity\u201d<\/strong> user (and possibly any other user you want, such as an FTP user). But for doing this, you will need to disable inheritance. For this, click on \u201cAdvanced\u201d<\/strong>, then click on \u201cDisable inheritance\u201d<\/strong>.<\/p>\n

\"\"<\/a><\/p>\n

After this you will prompted for copying the current settings or starting with no settings. You can select any option, but, it is best to copy the current settings and then remove the unnecessary permissions. Therefore, select \u201cConvertConcert inherited permissions into explicit permission on this object\u201d<\/strong> and then click on OK<\/strong>.<\/p>\n

Now, you need to remove the unnecessary permissions. Click on Edit<\/strong> and remove everything other than the \u201cSYSTEM\u201d<\/strong> and \u201cAdministrators\u201d<\/strong> groups. Then you need to add the \u201cApplicationPoolIdentity\u201d<\/strong> user to this folder. For this, click \u201cAdd\u2026\u201d<\/strong>. Based on your server configuration, you might be prompted for authenticating to an active directory domain. Click the cancel button a few times until you get the Select Users of Groups<\/strong> screen as below.<\/p>\n

\"\"<\/a><\/p>\n

Here, make sure that the \u201cLocation\u201d<\/strong> selected is your computer. In case it\u2019s not, click \u201cLocations\u2026\u201d<\/strong> and select your computer (at the top; you might need to click cancel on some authentication windows here as well).<\/p>\n

The \u201cApplicationPoolIdentity\u201d<\/strong> user is a hidden user, so you can\u2019t search for this user. For this, you will need to type the username to add it. You will need to type the username as “IIS AppPool\\<applicationpoolname>”<\/strong>. Please check the following example and fill your information accordingly:<\/p>\n

\"\"<\/a><\/p>\n

After you type the user name, click on OK<\/strong>. After adding the user, that is by default only granted read permissions, check your security settings if they appear similar to the following image, and then click on OK<\/strong>.<\/p>\n

\"\"<\/a><\/p>\n

Now, you have a secure site ready to be viewed by others without worrying about the hackers.<\/p>\n

Securing within Powershell<\/h3>\n

In case you\u2019re looking get known to some Powershell, the steps covered in this article are also applicable for Windows Server 2012 or newer server through Powershell. Just fill out the first two variables with your domain name and the path to your content, and then run the remaining PowerShell commands to set up the site in IIS and configure folder permissions.<\/p>\n

[String]$Domain = \u2018\u2019<\/pre>\n
[String]$Root = \u2018\u2019<\/pre>\n
Import-Module WebAdministration<\/pre>\n
#Create App pool & Website\r\nNew-WebAppPool -Name $Domain\r\nNew-Website -Name $Domain -HostHeader $Domain -PhysicalPath $Root -ApplicationPool $Domain\r\nSet-WebConfigurationProperty -Filter system.webServer\/security\/authentication\/anonymousAuthentication -Location $Domain -PSPath MACHINE\/WEBROOT\/APPHOST -Name userName -Value ''<\/pre>\n
#Optionally add www. Binding\r\nNew-WebBinding -Name $Domain -HostHeader www.$Domain -ErrorAction<\/pre>\n
#Remove inheritance (copy)\r\n$ACL = Get-ACL $Root\r\n$ACL.SetAccessRuleProtection($True,$True) | Out-Null\r\n$ACL.Access | ?{ !(($_.IdentityReference -eq 'NT AUTHORITY\\SYSTEM') -or ($_.IdentityReference -eq 'BUILTIN\\Administrators')) } | %{ $ACL.RemoveAccessRule( $_ ) } | Out-Null\r\n$ACL | Set-ACL<\/pre>\n
#Add IIS user permissions\r\n$ACL = Get-ACL $Root\r\n$acl.SetAccessRuleProtection($False, $True)\r\n$Rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\"IIS AppPool\\$Domain\", \"ReadAndExecute\", \"ContainerInherit, ObjectInherit\", \"None\", \"Allow\")\r\n$acl.AddAccessRule($Rule)\r\n$acl | Set-Acl<\/pre>\n
Additional Notes:<\/strong> In some cases, sites might require additional write or modify permissions on specific files or folders for cache files, file uploads, or other content. You should not apply modified permissions to the complete site. Instead, alter specific directories or files as needed. For applying these settings, go to the file or folder that needs modification, right-click on it, and select Properties<\/strong>. Jump to the Security<\/strong> tab and click on Edit<\/strong>. Then select the user comprises of the name of the website (milesweb.com in my example above), under the Allow column select modify, and then click OK<\/strong>. This will give the ApplicationPoolIdentity<\/strong> and IIS will be able to write to or modify the file(s) or folder(s).<\/p>\n
In this way you can secure your website in IIS.<\/p>\n","protected":false},"excerpt":{"rendered":"
The most common root cause is poor file security or poor configuration selection in terms of the ways IIS should access the file content while investigating site infections or defacing on a Windows Servers. You can prevent this in an easiest way by simply starting a secure site. To setup a website in IIS is […]<\/p>\n","protected":false},"author":16,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[907,908,431],"class_list":["post-6215","post","type-post","status-publish","format-standard","placeholder-for-hentry","category-web-hosting-faq","tag-iis","tag-secure-your-website","tag-website-security"],"yoast_head":"\nWays to Secure Your Website in IIS<\/title>\n<meta name=\"description\" content=\"The article described ways to secure your website in IIS.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ways to Secure Your Website in IIS\" \/>\n<meta property=\"og:description\" content=\"The article described ways to secure your website in IIS.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting FAQs by MilesWeb\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-26T11:27:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png\" \/>\n<meta name=\"author\" content=\"Pallavi Godse\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pallavi Godse\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/\",\"name\":\"Ways to Secure Your Website in IIS\",\"isPartOf\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png\",\"datePublished\":\"2019-07-26T11:27:18+00:00\",\"author\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/7e3952607fa9eb4e82fea9f7cad9c945\"},\"description\":\"The article described ways to secure your website in IIS.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png\",\"contentUrl\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ways to Secure Your Website in IIS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/\",\"name\":\"Web Hosting FAQs by MilesWeb\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/7e3952607fa9eb4e82fea9f7cad9c945\",\"name\":\"Pallavi Godse\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/eefc9695ea2b2c6e143c9c9919701aaa?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/eefc9695ea2b2c6e143c9c9919701aaa?s=96&d=blank&r=g\",\"caption\":\"Pallavi Godse\"},\"description\":\"Pallavi is a Digital Marketing Executive at MilesWeb and has an experience of over 4 years in content development. She is interested in writing engaging content on business, technology, web hosting and other topics related to information technology.\",\"url\":\"https:\/\/www.milesweb.co.uk\/hosting-faqs\/author\/pallavi\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ways to Secure Your Website in IIS","description":"The article described ways to secure your website in IIS.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/","og_locale":"en_GB","og_type":"article","og_title":"Ways to Secure Your Website in IIS","og_description":"The article described ways to secure your website in IIS.","og_url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/","og_site_name":"Web Hosting FAQs by MilesWeb","article_published_time":"2019-07-26T11:27:18+00:00","og_image":[{"url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png","type":"","width":"","height":""}],"author":"Pallavi Godse","twitter_misc":{"Written by":"Pallavi Godse","Estimated reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/","name":"Ways to Secure Your Website in IIS","isPartOf":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage"},"image":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage"},"thumbnailUrl":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png","datePublished":"2019-07-26T11:27:18+00:00","author":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/7e3952607fa9eb4e82fea9f7cad9c945"},"description":"The article described ways to secure your website in IIS.","breadcrumb":{"@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#primaryimage","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png","contentUrl":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-content\/uploads\/2019\/07\/01-min.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/ways-to-secure-your-website-in-iis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/"},{"@type":"ListItem","position":2,"name":"Ways to Secure Your Website in IIS"}]},{"@type":"WebSite","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#website","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/","name":"Web Hosting FAQs by MilesWeb","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/7e3952607fa9eb4e82fea9f7cad9c945","name":"Pallavi Godse","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/eefc9695ea2b2c6e143c9c9919701aaa?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eefc9695ea2b2c6e143c9c9919701aaa?s=96&d=blank&r=g","caption":"Pallavi Godse"},"description":"Pallavi is a Digital Marketing Executive at MilesWeb and has an experience of over 4 years in content development. She is interested in writing engaging content on business, technology, web hosting and other topics related to information technology.","url":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/author\/pallavi\/"}]}},"views":925,"_links":{"self":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/6215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/comments?post=6215"}],"version-history":[{"count":2,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/6215\/revisions"}],"predecessor-version":[{"id":6226,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/posts\/6215\/revisions\/6226"}],"wp:attachment":[{"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/media?parent=6215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/categories?post=6215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.milesweb.co.uk\/hosting-faqs\/wp-json\/wp\/v2\/tags?post=6215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}