Install and Configure IIS

By Kokil Thapa | Last reviewed: September 2026

You need to install and configure IIS when a client stack runs on Windows Server instead of Linux. Internet Information Services is Microsoft's built-in web server. It handles ASP.NET, static sites, reverse proxies, and PHP workloads on corporate or hybrid networks. Most of my production work sits on Ubuntu with Apache or Nginx. I still configure IIS when a business already owns Windows licensing, Active Directory, or legacy .NET apps. This guide walks through a clean IIS setup you can repeat on Server 2022 or Server 2025, from role installation through HTTPS, application pools, and hardening.

How do you install IIS on Windows Server?

IIS ships as a Windows Server role, not a separate download. You install it through Server Manager or PowerShell. Pick the method your operations team already uses. GUI installs are easier for one-off servers. PowerShell scales better across many hosts.

Install IIS with Server Manager

1. Sign in as a local administrator on Windows Server 2022 or 2025.
2. Open Server Manager and choose Add roles and features.
3. Select Role-based or feature-based installation and pick the current server.
4. Check Web Server (IIS) on the Server Roles screen.
5. Accept the management tools prompt and click through to Role services.
6. Enable the services your stack needs. Static HTML needs fewer options than ASP.NET or PHP.
7. Confirm and wait for the feature installation to finish. Reboot only if Windows requests it.

After installation, open IIS Manager from Tools in Server Manager. You should see a default site listening on port 80. Browse to the server IP from another machine on the LAN. The IIS welcome page confirms the role is active.

Install IIS with PowerShell

For repeatable builds, PowerShell is faster and auditable. Run this in an elevated session:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

Install-WindowsFeature -Name Web-Asp-Net45, Web-CGI, Web-WebSockets, `
  Web-Mgmt-Service, Web-Stat-Compression, Web-Filtering

The second command adds common production services. Adjust the list before you run it. ASP.NET 4.x uses Web-Asp-Net45. PHP through FastCGI needs Web-CGI. URL Rewrite is a separate download from Microsoft and is not included in the base role.

If you normally deploy on Linux, compare this flow with an Nginx install on Ubuntu. The concepts match. Only the tooling differs. IIS uses application pools instead of separate PHP-FPM pools. Bindings replace virtual host blocks.

Which IIS features should you enable for a web application?

Feature selection is where many IIS builds go wrong. Installing every checkbox creates attack surface and wasted RAM. Install what your application reads at runtime. Add more later if a module error appears in the Event Log.

Request Filtering ships with IIS and blocks dangerous extensions by default. Keep it enabled. Pair it with Windows Firewall rules that allow only 80, 443, and your RDP jump box source IPs.

On budget-sensitive Nepal SMB projects, Windows Server licensing can exceed Rs 25,000/month (~USD 185) on cloud VMs. That is why I often recommend Linux hosting with domain registration for Laravel or WordPress. IIS still wins when the client already runs Active Directory, Exchange, or SQL Server on the same machine.

Application pools and worker processes

Every IIS site runs inside an application pool. The pool controls the worker process identity, recycling schedule, and .NET CLR version. Create one pool per application in production. Shared pools let a crashing app take down neighbours.

• Set .NET CLR version to No Managed Code for PHP or static sites.
• Use ApplicationPoolIdentity unless the app needs a domain service account.
• Disable idle timeout for low-traffic admin panels that must stay warm.
• Enable Regular time interval recycling during off-peak hours only.

How do you configure IIS for PHP or ASP.NET hosting?

Once the role is installed, configuration happens in IIS Manager and a few XML files under C:\inetpub\. The goal is a site that serves your document root, executes scripts safely, and logs errors you can trace.

Create a site and physical path

1. In IIS Manager, expand the server node and right-click Sites.
2. Choose Add Website. Enter a site name such as client-portal.
3. Set the physical path to your deployment folder, for example C:\sites\client-portal\public.
4. Add an HTTP binding on port 80 with the host name portal.example.com.
5. Select the dedicated application pool you created earlier.
6. Click OK and stop the default site if it also claims port 80.

Grant the application pool identity read and execute rights on the site folder. Use icacls from an elevated prompt:

icacls "C:\sites\client-portal" /grant "IIS AppPool\client-portal":(RX) /T

Write access should be limited to storage, uploads, or logs subfolders. Never give broad write permission on the entire web root.

Configure PHP through FastCGI

For PHP 8.3 or 8.5 on IIS, download the Non Thread Safe ZIP build from windows.php.net. Extract to C:\PHP. Register the handler in IIS Manager under Handler Mappings or use the official PHP IIS configuration script where available.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <fastCgi>
      <application fullPath="C:\PHP\php-cgi.exe"
                   monitorChangesTo="C:\PHP\php.ini"
                   activityTimeout="600"
                   requestTimeout="600" />
    </fastCgi>
    <handlers>
      <add name="PHP_via_FastCGI"
           path="*.php"
           verb="GET,HEAD,POST"
           modules="FastCgiModule"
           scriptProcessor="C:\PHP\php-cgi.exe"
           resourceType="Either" />
    </handlers>
  </system.webServer>
</configuration>

Set extension_dir, enable required extensions in php.ini, and confirm phpinfo() loads before you deploy Laravel or WordPress. Laravel 13 needs PHP 8.3 or higher. Laravel 12 runs on PHP 8.2+. Match your framework version before you tune FastCGI timeouts for long imports.

Detailed PHP tuning on Windows is covered in our companion post on hosting PHP on IIS. Database layers still run separately. Install MySQL or SQL Server and point your .env connection string at localhost or a remote host.

Configure ASP.NET and static SPA fallback

ASP.NET Framework apps publish through Visual Studio or msbuild into the site folder. Set the application pool to .NET CLR v4.0 and Integrated pipeline mode. For Vue or React SPAs built with Vite 8.x, copy the dist folder to the IIS root and add a URL Rewrite rule:

<rule name="SPA fallback" stopProcessing="true">
  <match url=".*" />
  <conditions logicalGrouping="MatchAll">
    <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
    <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
  </conditions>
  <action type="Rewrite" url="/index.html" />
</rule>

Place that inside system.webServer/rewrite/rules in the site web.config. Without it, deep links return 404 after refresh.

How do you set up HTTPS and bindings in IIS?

Production sites need TLS on port 443. IIS bindings map IP, port, and host header to a certificate. You can bind multiple domains on one server using SNI.

Obtain and bind a certificate

1. Import a PFX from your CA, or use win-acme for Let's Encrypt on Windows.
2. Open IIS Manager and select your site. Click Bindings.
3. Add an HTTPS binding on port 443 with the correct host name.
4. Select the imported certificate from the drop-down list.
5. Require Server Name Indication when several TLS sites share one IP.
6. Remove plain HTTP or add a redirect rule to HTTPS once TLS is verified.

The process parallels installing SSL certificates on Ubuntu, but certificate stores live in the Windows Local Computer vault. Renewals must update the bound cert before expiry. Browsers will hard-fail otherwise.

Force HTTPS with URL Rewrite when you cannot remove the port 80 binding:

<rule name="HTTP to HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions>
    <add input="{HTTPS}" pattern="off" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>

After binding, test with SSL Labs or your browser dev tools. Verify the full chain is served. Mixed-content warnings often mean hard-coded http:// asset URLs in templates.

For performance work after TLS is live, review compression, output caching, and static asset expiry. Those changes mirror the goals in our speed optimization service on Linux stacks.

How do you harden and troubleshoot IIS in production?

A default IIS install is not production-ready. Remove sample content, restrict verbs, and log enough detail to debug 500 errors without exposing secrets to visitors.

Security baseline

• Disable the default site and delete C:\inetpub\wwwroot sample files you do not need.
• Remove WebDAV unless the application requires it.
• Deny double-encoded requests and non-ASCII headers in Request Filtering.
• Run the IIS Crypto or equivalent tool to disable TLS 1.0 and 1.1.
• Apply Windows Update on a schedule. IIS patches ship through the OS channel.
• Store connection strings and API keys outside web.config when possible. Use environment variables or Azure Key Vault on cloud hosts.

Generate strong app secrets with a local password generator tool during staging setup. Paste them into environment-specific config, not into source control.

Logging and common errors

Enable W3C logging on each site. Logs land in C:\inetpub\logs\LogFiles\ by default. Turn on Failed Request Tracing for status codes 500–599 while debugging. Remember to disable verbose tracing after the incident.

Typical failures I see during website migration projects include wrong NTFS permissions on upload folders, 32-bit DLLs loaded into 64-bit pools, and FastCGI timeouts on large Excel exports. Check the Windows Event Viewer under Windows Logs → Application when IIS Manager only shows a generic 500 page.

Use these commands from an elevated PowerShell session:

Import-Module WebAdministration
Get-WebBinding
Restart-WebAppPool -Name "client-portal"
iisreset /status

Get-WebBinding confirms host headers and certificates. Pool restarts clear stuck FastCGI workers without rebooting the whole server.

Microsoft documents site creation and binding syntax on Learn: Creating websites in IIS. The IIS 10 overview explains kernel-mode caching and HTTP/2 support on current Windows Server releases. Treat those pages as the authoritative reference when a GUI label changes between versions.

If your team lacks Windows admin capacity, consider managed Linux hosting and ongoing support and maintenance instead of forcing an unfamiliar stack. IIS shines when the organisation already pays for Windows Server and needs tight integration with corporate identity systems.

On a legal-tech portal I built, the production stack ran Linux with Apache and PHP-FPM. A sibling staging environment mirrored client Active Directory on IIS for SSO testing. That split layout is common. Build where the app lives long term. Use IIS where enterprise policy requires it.

Our Mijar Law Associates portfolio entry shows what a fully tuned Linux deployment looks like for comparison. Custom web development should pick the server OS during architecture, not after code is finished.

For reverse-proxy patterns in front of app servers, read configure a caching reverse proxy. ARR on IIS fills a similar role to Nginx upstream blocks. UFW firewall rules on Ubuntu translate to Windows Firewall with Advanced Security inbound allow lists on IIS hosts.

Need JSON config snippets while editing web.config? Paste them through the JSON formatter tool on this site to catch trailing commas before deployment. Small checks prevent late-night rollback calls.

Read about my background across Laravel, Linux, and hybrid Windows environments. Client feedback on customer reviews reflects full-stack delivery, including migration and hardening work after go-live.

Key Takeaways

• Install the Web Server (IIS) role with only the services your stack needs—CGI for PHP, ASP.NET 4.8 for Framework apps, ARR for reverse proxy.
• Create one application pool per site, grant NTFS permissions to the pool identity, and stop the default site before binding port 80.
• Map PHP through FastCGI with Non Thread Safe builds; set FastCGI timeouts before running long imports or reports.
• Bind HTTPS on port 443 with a valid certificate and SNI; redirect HTTP to TLS in URL Rewrite or at the binding layer.
• Enable W3C logs and Failed Request Tracing for 5xx errors; check Event Viewer when IIS returns a generic error page.
• Choose IIS when Windows licensing and Active Directory integration already exist; choose Linux for most Laravel, WordPress, and budget-sensitive Nepal hosting.

People Also Ask

Is IIS free on Windows Server?

IIS is included with Windows Server licensing. You pay for the server OS and CALs, not a separate web server SKU. Windows Server Standard on a cloud VM often costs more per month than a comparable Linux instance. For a small business in Nepal, that cost gap can exceed Rs 8,000/month (~USD 60) before you add SQL Server or Remote Desktop CALs.

Can IIS run Laravel or WordPress?

Yes. Both run on IIS through PHP FastCGI with URL Rewrite handling pretty URLs. Laravel 13 needs PHP 8.3+. Laravel 12 supports PHP 8.2+. Most production Laravel and WooCommerce 11.1 sites I deploy still sit on Linux with Nginx or Apache because tooling, Composer workflows, and MySQL on Ubuntu guides are simpler to automate there.

What is the difference between IIS and Nginx?

IIS integrates deeply with Windows, Active Directory, and ASP.NET. Nginx on Linux is lightweight, widely documented for PHP-FPM, and typical for Laravel and WordPress hosting. IIS uses application pools and GUI bindings. Nginx uses server blocks and manual file edits. Both support reverse proxy, TLS termination, and static file caching.

How do you restart IIS without rebooting the server?

Use iisreset for a full restart, or recycle a single application pool from IIS Manager when one site misbehaves. Pool recycling clears stuck PHP FastCGI workers without dropping other sites on the same machine. Schedule full iisreset runs during maintenance windows only.

Deploy with confidence on Windows or Linux

To install and configure IIS correctly, treat role selection, pool identity, HTTPS bindings, and logging as one workflow—not separate tasks after go-live. Verify PHP or ASP.NET handlers, permissions, and TLS before you point DNS at the box. Keep URL Rewrite rules in source control alongside your web.config so staging and production stay aligned.

If you are choosing between a Windows IIS stack and a Linux path for your next project, contact us for architecture guidance. We handle enterprise application development, migration, and the testing and optimization pass that turns a fresh IIS install into a stable production host.