IIS Necessary Security Settings

This document is intended to guide server administrators in how to secure their IIS settings.

Perform these steps on your webserver so ISO will allow access to it:

  • Enable HSTS
  • Disable Anonymous Access
  • Disable HTTP TRACE
  • Disable Version
  • Remove IP from Location Header

 

Enable HSTS 

  1. Open IIS Manager

Screenshot of a Windows Start menu search result showing the desktop application “Internet Information Services (IIS) Manager.” The IIS icon appears on the left, with the label “Internet Information Services (IIS) Manager” and the subtitle “Desktop app” displayed beneath it on a light gray background.

  1. Select the site
  2. Click HTTP Response Headers

Screenshot of a Windows application shortcut icon labeled “HTTP Response”. The icon appears as a white document with small green and yellow graphical elements and a blue stripe near the bottom. The text “HTTP Respon...” is visible beneath the icon, indicating the label is truncated. Partial labels of adjacent icons are visible on either side against a light gray background.

  1. Add
    1. Name = Strict-Transport-Security
    2. Value = max-age=31536000
  2. Ok

Screenshot of Internet Information Services (IIS) Manager with the Default Web Site selected in the Connections pane. The central panel is titled “HTTP Response Headers” and displays a table of configured response headers. One visible entry is Strict-Transport-Security with a value beginning “max-age=31536000” and an entry type of “Local.” The Actions pane on the right contains options including Add..., Set Common Headers..., and Help. The interface is shown in the standard Windows IIS management console layout.

 

Disable Anonymous Access

1.  Open IIS Manager

Screenshot of a Windows Start menu search result showing the desktop application “Internet Information Services (IIS) Manager.” The IIS icon appears on the left, with the label “Internet Information Services (IIS) Manager” and the subtitle “Desktop app” displayed beneath it on a light gray background.

2.  On the TreeView on the left, browse to the directory you wish to disable Anonymous Access for and click on it to select it. 

In this case it is HOUSINGPRD -> Sites -> Default Web Site -> CFIDE -> administrator.  This will display all of the configuration settings that can be applied to this web directory.  Open up 'Authentication' by double clicking on it.

IIS Manager showing the CFIDE/administrator folder selected and its available configuration features.

3.  Select Anonymous Authentication in the middle pane, and set it to 'Disabled' using the 'Disable' Action in the right hand pane.
Select Windows Authentication in the middle pane, and set it to 'Disabled' using the Action pane on the right.
IIS Manager Authentication settings showing Windows Authentication enabled and the Enable action highlighted.

 

Disable HTTP TRACE

1) open an elevated command prompt, then navigate to the following folder:

  • C:\Windows\System32\inetsrv\

2) type the following command, replacing "NameOfSite" with the name of the site to disable HTTP TRACE, then run the command.

  • C:\Windows\System32\inetsrv\appcmd.exe set config "NameOfSite" /section:requestfiltering /+verbs.[verb='TRACE',allowed='false']

 

As verification the configuration took affect, perform the following commands:

  a) open IIS Manager

  b) highlight the site you've made the configuration to, located within the left pane

IIS Manager navigation pane with the FusionMemberPortal website highlighted under Sites.

  b) double-click the "Request Filtering" button located within the middle pane

FusionMemberPortal site settings in IIS Manager with Request Filtering highlighted.

  c) click the "HTTP Verbs" tab within the top-middle pane

Request Filtering settings in IIS Manager with the HTTP Verbs tab highlighted.

 d) you should see an entry for TRACE that's set to false under the "Allowed" column

Request Filtering settings showing the TRACE HTTP verb with Allowed = False.

Disable Version

Edit the Web.Config file for your site using your favorite text editor.

Note: The web.config file is primarily located in the root directory of your web application or website.

Application Root Folder: Found in the main directory where your website files are stored (e.g., C:\inetpub\wwwroot\YourAppName\).

Ensure that requestFiltering line is in the web.config

web.config file showing settings that disable the TRACE and TRACK HTTP verbs and configure security-related HTTP headers.

Web.config code snippet showing TRACE and TRACK HTTP verbs disabled in the request filtering configuration.

 

Remove IP from Location Header

  1. Log in to IIS Manager
  2. Configuration Editor

IIS Manager showing the Default Web Site selected with the Request Filtering feature available in the site settings.

  1. Change section to system.webServer/serverRuntime
  2. Set FQDN at alternateHostName

IIS Configuration Editor showing the system.webServer/serverRuntime settings section.

  1. Apply
100% helpful - 1 review
Print Article