How to Host a Website on IIS (Windows Server)

IIS is the web server built into Windows Server. It is what you use when the application is ASP.NET, when a team knows Windows, or when the server is Windows for other reasons and also needs to serve a site. Here is the setup from a clean Windows Server 2022 to a live HTTPS site.

1. Install IIS

In PowerShell as Administrator:

Install-WindowsFeature -Name Web-Server -IncludeManagementTools

That installs the core web server and IIS Manager. Add the pieces most sites need:

Install-WindowsFeature Web-Asp-Net45, Web-Net-Ext45, Web-Http-Redirect, Web-Http-Logging, Web-Stat-Compression, Web-Dyn-Compression, Web-Filtering, Web-Basic-Auth, Web-Windows-Auth

Browse to http://localhost on the server: the IIS start page confirms it is running. Open port 80 and 443 in Windows Firewall if they are not already (the Web-Server feature usually does this).

2. Create a site

Open IIS Manager (inetmgr). In the left tree, right-click Sites → Add Website:

• Site name: example.com
• Physical path: C:\inetpub\sites\example.com — create it; do not put sites under wwwroot.
• Binding: type http, port 80, Host name example.com.

Add a second binding for www.example.com. The host name is what lets one server serve many sites on the same IP.

Each site gets its own application pool (created automatically with the same name). Under Application Pools, set the pool's .NET CLR version to No Managed Code for PHP or static sites, v4.0 for ASP.NET Framework, and leave the identity as ApplicationPoolIdentity — a low-privilege account unique to that pool.

Give that identity read access to the site folder: right-click the folder → Properties → Security → Edit → Add → IIS AppPool\example.com. Grant Modify only on subfolders the application must write to (uploads, logs).

3. Point DNS and test

An A record for example.com and www to the server's IP. Drop an index.html into the folder and load the site. If you see the IIS start page instead of your file, the binding's host name does not match; if you see a 403, the folder permission is missing.

4. HTTPS with a free certificate

win-acme is the Windows equivalent of certbot. Download it, unzip to C:\tools\win-acme, and run:

cd C:\tools\win-acme
.\wacs.exe

Choose N (create certificate with default settings), pick the site from the list, and it validates via HTTP, installs the certificate, adds the https binding on port 443, and schedules renewal as a Windows task. Test at https://example.com.

Redirect HTTP to HTTPS: install the URL Rewrite module (from Microsoft's site), then on the site, URL Rewrite → Add Rule → Blank rule, or add to web.config:

<system.webServer>
  <rewrite>
    <rules>
      <rule name="HTTPS" stopProcessing="true">
        <match url="(.*)" />
        <conditions><add input="{HTTPS}" pattern="off" /></conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

5. PHP on IIS

Install PHP via the Web Platform Installer or manually: download the NTS (non-thread-safe) build from windows.php.net, unzip to C:\php, then in IIS Manager → Handler Mappings → Add Module Mapping:

• Request path: *.php
• Module: FastCgiModule
• Executable: C:\php\php-cgi.exe

Add index.php under Default Document. WordPress runs fine like this, though it is happier on Linux — the URL rewrite rules WordPress writes for Apache need translating into web.config, and the WordPress documentation has the equivalent block.

6. ASP.NET Core

Install the .NET Hosting Bundle for your .NET version (it installs the ASP.NET Core Module for IIS), publish the app to the site folder, set the pool to No Managed Code, and IIS proxies to the Kestrel process the module starts. The web.config the publish step creates handles it.

Logs and troubleshooting

Site logs are under C:\inetpub\logs\LogFiles\W3SVC<id>\. For errors, turn on Failed Request Tracing for the site, which writes an XML trace per failing request with the exact module and reason — far more useful than a generic 500. Detailed errors for the browser are under Error Pages → Edit Feature Settings → Detailed errors (turn back to Local requests only when done).

Or use Plesk

Plesk for Windows does all of the above from a panel — sites, pools, PHP versions, certificates, DNS, mail — and is the sensible choice if the server will host more than a site or two. Whether the workload belongs on Windows at all is discussed in Windows Server vs Linux for hosting.