Windows

Install IIS and host websites on Windows Server VPS

BM BizMaC Team Jul 29, 2026 10 min read

You provision a Windows Server VPS, Remote Desktop in, and the first thought isn't "I need a web server", until a client drops a legacy ASP.NET app on your lap, or you decide to run a corporate intranet with Active Directory integration. IIS is the native HTTP stack on Windows, and it still handles a material share of the enterprise web. This guide walks through installing IIS on a fresh Windows Server 2025 or 2022 instance, binding a domain, enabling HTTPS, and hardening the setup before it sees a single visitor.

Prerequisites

  • A Windows Server VPS running Windows Server 2025 or 2022 (Desktop Experience or Core, this guide uses Desktop Experience for the GUI parts, but every command also works from PowerShell).
  • Local Administrator access (the built-in Administrator account or a member of the Administrators group).
  • An RDP client, mstsc.exe on Windows, Microsoft Remote Desktop on macOS, Remmina / FreeRDP on Linux.
  • IPv4 connectivity to the VPS port 3389 already open (stock Windows Server allows RDP from any IP, see the securing-RDP post to lock that down).

Why IIS over a third-party web server on Windows?

IIS is built into Windows Server. No extra licensing, no third-party repos, no separate package manager. It integrates with Windows authentication (Kerberos, NTLM, Active Directory) out of the box, something Apache or Nginx on Windows never does cleanly. For .NET Framework / ASP.NET applications, IIS is the runtime host; you can't run them elsewhere without significant rewriting. That alone makes IIS the default choice for enterprise Windows workloads.

Windows Server 2025 ships with IIS 10.0. The feature set includes centralised certificate management, Application Request Routing (ARR) for reverse proxying, Web Deploy for no-downtime publishing, and FTP/S over the same management console. If your stack is .NET-based or requires Windows-integrated auth, IIS is not optional, it's the only practical option.

Step 1, Install the IIS role

Two paths: Server Manager (GUI) or PowerShell. The result is identical.

Via Server Manager

  1. Open Server Manager (it starts automatically on login).
  2. Click Manage → Add Roles and Features.
  3. Role-based or feature-based installation → select your server.
  4. Check Web Server (IIS). A pop-up asks you to add management tools, accept.
  5. Click through: the default IIS installation includes Static Content, Default Document, Directory Browsing, HTTP Errors, HTTP Logging, Request Monitor, and the IIS Management Console. That is enough for a first site.
  6. Install. Reboot is not required.

Via PowerShell (faster, repeatable)

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

That single command installs the IIS role plus the IIS Manager console. One line, done.

Verify: Open a browser on the VPS and go to http://localhost. You should see the default IIS welcome page, a grey "Welcome" screen with the IIS logo.

Get-Service W3SVC | Format-Table Status,Name

# Output should show:
# Status Name
# ------ ----
# Running W3SVC

Step 2, Configure the default site and bind a domain

The default IIS site listens on port 80 on every IP. You want to bind it to your domain.

  1. Open IIS Manager (search "IIS" in Start).
  2. In the left Connections pane, expand the server node → Sites → right-click Default Web Site → Edit Bindings.
  3. Select the http row → Edit.
  4. Set Host name to www.your-domain.com (or the exact domain you own). Keep IP address All Unassigned and port 80.
  5. Click OK.

Now IIS responds only to requests that carry that Host header. Requests to the raw IP or any other name get a 404 unless you add another binding. You want this, it lets you host multiple sites on one IP using host headers.

If you don't control DNS yet: point an A record at your Windows VPS dedicated IPv4. On a rent a VPS in Vietnam setup this takes minutes in the control panel. For testing, edit C:\Windows\System32\drivers\etc\hosts on your local machine, but that works only for yourself.

Step 3, Publish content to the site directory

The default content root is C:\inetpub\wwwroot. Drop your files there. For a static site: copy index.html and assets. For ASP.NET: publish the app via Visual Studio or dotnet publish and copy the output folder.

If you use Web Deploy (recommended for frequent updates): enable the service via Server Manager → Add Roles and Features → Management Tools → IIS Management Console → Management Service. The default Web Deploy port is 8172. See the Microsoft docs for publisher settings, a full Web Deploy setup takes about ten minutes and saves hours across a project lifetime.

Verify: From a browser outside the VPS (your local machine), navigate to http://www.your-domain.com. You should see your content, not the IIS default page.

Step 4, Enable HTTPS with a free Let's Encrypt certificate

Every site on the public internet should answer on HTTPS. IIS does not have a built-in ACME client, but several third-party tools work. The most maintained is win-acme (formerly letsencrypt-win-simple).

  1. Download the latest win-acme.v2.x.x.zip release from its GitHub page.
  2. Extract to C:\win-acme.
  3. Open PowerShell as Administrator:
cd C:\win-acme
.\wacs.exe
  1. Select M (Create certificate (full options)).
  2. Choose 1 (Single binding of an IIS site).
  3. Pick your site from the list, the one you bound your domain to.
  4. Accept the Terms of Service, choose default options for file location.
  5. win-acme creates the certificate and binds it to port 443 in IIS automatically. It also sets up a scheduled task for autorenewal (every 60 days by default).

Verify: Open https://www.your-domain.com. The lock icon should show a valid certificate. In IIS Manager, the site bindings now show an https entry with the Let's Encrypt certificate thumbprint.

# Check the certificate binding from PowerShell:
Get-IISSiteBinding | Where-Object {$_.Protocol -eq 'https'}

Step 5, Configure Windows Firewall for web traffic

Windows Defender Firewall with Advanced Security blocks inbound HTTP/HTTPS by default. You must allow them. From an elevated PowerShell:

New-NetFirewallRule -DisplayName "IIS HTTP (80)" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
New-NetFirewallRule -DisplayName "IIS HTTPS (443)" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

If you plan to use Web Deploy (port 8172) or FTP (port 21 + passive range), add those rules too.

Verify: Get-NetFirewallRule -DisplayName "IIS HTTP (80)" | Format-Table Enabled, Action should show True Allow.

Windows Server 上设置 IIS 时需要开启 80 和 443 端口，并绑定域名证书。

Setting up IIS on Windows Server requires opening ports 80 and 443, then binding a domain certificate.

Step 6, Hardening the IIS installation

A default IIS install is production-ready but not hardened. These four changes prevent the most common misconfigurations:

  1. Remove the default documents you don't need, go to IIS Manager → Default Document. Delete iisstart.htm and iisstart.png (they're the welcome page). Keep index.html, index.htm, default.aspx if you use them.
  2. Disable directory browsing globally, IIS Manager → server node → Directory Browsing → Open Feature → select Disabled. A 403 on a directory without a default document is better than a listing.
  3. Remove the IIS response header, the server version leak (Server: Microsoft-IIS/10.0) is a fingerprint. Use URL Rewrite (install via Web Platform Installer or download from Microsoft) and add an outbound rule to remove the Server header. Or use IIS Manager → HTTP Response Headers to add X-Content-Type-Options: nosniff and X-Frame-Options: DENY.
  4. Restrict verbs and request filtering, IIS Manager → server node → Request Filtering. Edit Feature Settings and set Maximum URL length to 4096, Maximum query string to 2048, Deny URL sequences to .. (prevents directory traversal).

These changes take effect immediately, no service restart needed for most.

Step 7, Set up logging and monitor the site

IIS logs every request to %SystemDrive%\inetpub\logs\LogFiles\W3SVC[site-id]. The default format is W3C Extended. Logs rotate daily.

Use Log Parser Studio (free from Microsoft) to query these logs like a database. Or pipe them into a central SIEM if you run one. Key metrics to watch: 40x and 50x rates, request-per-second trends, and unusual user-agent strings.

For basic uptime monitoring, check the service:

Get-Service W3SVC | Select-Object Status, StartType

Set a simple scheduled task that emails you if W3SVC stops. A one-line PowerShell check in Task Scheduler running every minute costs nothing and prevents silent outages.

Troubleshooting

  • "Cannot connect, connection refused" on port 80/443 → check the firewall rule (Step 5). Also check if another process (Skype, a previous Apache install) already listens on port 80: netstat -ano | findstr :80. The owner PID is in the last column; match it with tasklist /FI "PID eq [number]".
  • Certificate shows as invalid/untrusted in browser → ensure the complete chain was installed. In IIS Manager, open Server Certificates → double-click the cert; it should show "This certificate is OK". If the chain is broken, re-run win-acme and select "Store with intermediate" during certificate creation.
  • "403 Forbidden, Directory Listing Denied" → you browsed a folder that has no default document (index.html, default.aspx). Either add one or disable directory browsing if still enabled.
  • Slow first request after idle period → the default AppPool recycles after 20 minutes of inactivity. Set the idle timeout to 0 (never sleep) in IIS Manager → Application Pools → [your pool] → Advanced Settings → Process Model → Idle Time-out (minutes) → set to 0.

FAQ

Can I install IIS on Windows Server Core (no GUI)?

Yes. Use Install-WindowsFeature Web-Server from PowerShell. You manage the site via New-IISSite, Set-IISSiteBinding, and Import-Module IISAdministration commands. The experience is identical under the hood; no GUI overhead means slightly better resource use on a low-RAM VPS like a 2GB RAM plan.

Does IIS support reverse proxying?

Yes, via the Application Request Routing (ARR) extension. Install it through the Web Platform Installer. It lets you proxy requests to backend services, useful for Node.js, Python, or Dockerized apps running alongside IIS.

How do I host multiple sites on one IP?

Add multiple site bindings with different host headers. IIS Manager → Sites → right-click → Add Web Site. Each site gets its own binding (Host name) and content directory. They all share port 80/443. You need one IP per site only if you use SSL without SNI (but SNI is supported since IIS 8, so you're fine with host-header-based SSL).

Can I run IIS and Docker side by side on the same VPS?

Yes, as long as ports do not collide. Bind IIS to 80/443 directly; run Docker containers on other ports (8080, 3000...) and reverse-proxy through IIS / ARR, or use a separate port range and firewall rules. Keep both services resource-aware, a 4 GB RAM VPS can handle IIS + one or two containers without swapping.

What is the minimum hardware for IIS?

IIS itself uses about 200 MB of RAM idle. A 2 GB RAM VPS with a single vCPU is enough for a low-traffic ASP.NET site or a static site. For moderate load with an application pool and database (SQL Server Express), start at 4 GB RAM and 2 vCPUs. The monthly billing VPS plans at thueVPS cover this range with NVMe SSD storage, which matters more for IIS than raw CPU, I/O from log writing and static file serving benefits directly from fast storage.

Is IIS secure for public-facing sites?

Yes, when configured properly. Keep the server patched (Windows Update monthly), disable unused role services, lock down HTTP methods, and use the hardening steps from Step 6. IIS has a smaller attack surface than a full-blown control panel, and its request filtering module blocks many common attacks before they reach your app.

Related articles

Windows Server 上安装 IIS 并托管网站

本文详细介绍了在 Windows Server 2025 或 2022 上安装 IIS 的具体步骤，包括绑定域名、配置 SSL 证书、开放防火墙端口以及基本安全加固。面向系统管理员，所有命令均可直接运行。对于托管 ASP.NET 应用或需要 Windows 集成身份验证的场景，IIS 是最实用的选择。最低配置建议 2 GB 内存起步，推荐使用 NVMe 存储的 VPS 以获得更好的 IO 性能。

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.