What Is IIS (Internet Information Services) or Windows Web – IIS Alternatives
IIS, short for Internet Information Services, and formerly known as Internet Information Server, is a web server from Microsoft that was designed to be used with Windows products, starting with the NT family.
This web server is used to help Windows users host various content types on the web, such as media files, documents, or even full-fledged websites. At the time being, Apache is the most popular Windows web server, followed closely by IIS, which is quite impressive.
What is IIS?
IIS is a web server that’s easy to familiarize with, thanks to its intuitive Graphical User Interface (GUI) that lets you manage websites associated with the service and their related users. IIS’s GUI makes it easy to design, customize, configure and publish websites from a single location.
It has a built-in website management tool called IIS Manager that you can use to adjust options such as security settings, performance parameters, logging preferences, as well as error pages or default values for the websites you administrate.
From a technical standpoint, IIS is quite versatile, seeing that it can serve standard and dynamic webpages alike, without significant effort. Thus, you can use it to create and publish HTML web pages, but it’s nice knowing that you could also manage PHP pages and ASP.NET applications.
Thanks to its flexibility, IIS can run scripts and applications contained in dynamic web pages and display the results to the visitor’s web browser screen. With static websites the process is even easier: IIS just sends the HTML content and images (if any) to the visitor’s web browser.
What is IIS’s purpose?
Given that it benefits from Microsoft’s full support, and the fact that it comprises numerous advanced features, IIS makes a great choice for creating and managing commercial websites, such as e-shops or promotional portfolio websites.
The downside is that using IIS for commercial purposes also means that you’ll need a commercial license. Furthermore, the price of this license type varies depending on how many users you want to include.
So we’ve already established that IIS can be used to create and host a website, as well as the fact that it supports static and dynamic web content. However, IIS is much more than just that. For instance, you can use its built-in module support to enhance your server’s functionality.
It’s possible to install streaming modules on your server so that your website’s visitors can benefit from streaming media content. You can also use a URL Rewrite module that enables you to create powerful URL implementation rules so that visitors can remember them easily and search engines can find them faster.
Therefore, it goes without saying that if you need a quick way to create and publish a website, IIS is one of the best ways to go about it. The very best way still remains Apache HTTP thanks to it being open-source and letting you use it for free, regardless of the number of users.
IIS version history
It’s worth mentioning that initially, IIS was meant as an alternative to a web server that was developed as a research project. The first Microsoft-signed webserver project was distributed as freeware and was designed for EMWAC (European Microsoft Windows NT Academic Centre).
However, seeing that the EMWAC server couldn’t handle all traffic volume that was going to the microsoft.com website, the project was dropped and Microsoft developed its own web server in the form of IIS.
One notable aspect is that most versions of IIS were released with or alongside a version of the Windows operating system. Surely enough, back then IIS was merely a shadow of how we know it today; in fact, each Windows release could very well serve as a checkpoint for IIS’s evolution.
- IIS 1.0
- The first release of IIS
- Released as a free add-on for Windows NT 3.51
- IIS 2.0
- Included for free with Windows NT 4.0
- IIS 3.0
- Included with Windows NT 4.0 Service Pack 2
- Added Active Server Pages dynamic scripting environment
- IIS 4.0
- Released as a component of Windows NT 4.0’s Option Pack
- Added MMC-based administration application
- IIS 5.0
- Included with Windows 2000
- Added:
- New authentication methods
- WebDAV protocol support
- ASP enhancements
- HTTP.SYS
- Removed:
- Gopher protocol support
- IIS 5.1
- Included with Windows XP Professional
- Not much different than IIS 5.0
- IIS 6.0
- Included with Windows Server 2003 and the x64 edition of Windows XP Professional
- Added:
- IPv6 support
- A new worker process support to increase reliability and security
- Introduced HTTP.SYS as HTTP-specific HTTP requests port listener
- IIS 7.0
- Shipped with Windows Server 2008 and Windows Vista
- Added:
- New modular design for increased performance and reduced attack surface
- Hierarchy configuration system to help to deploy websites easier
- Windows Forms-based management application
- New command-line management options
- Better .NET Framework support
- Changed:
- Unlimited number of allowed connections
- Concurrent requests limited to 10 or 3, depending on the operating system
- Allows additional requests and queues them, instead of dropping them
- IIS 7.5
- Included in Windows Server 2008 R2 and Windows 7 (needs manual activation from Programs & Features)
- Added:
- TLS 1.1 and TLS 1.2 support
- Best Practices Analyzer tool
- Process isolation for application pools
- Improved:
- FTP and WebDAV modules
- Command-line administration in PowerShell
- IIS 8.0
- Available exclusively in Windows Server 2012 and Windows 8
- Added:
- SNI (SSL hostname binding)
- Centralized SSL certificate support
- Application Initialization
- Multi-core NUMA hardware scaling
- IIS 8.5
- Included in Windows Server 2012 R2 and Windows 8.1
- Added:
- Idle worker-Process page-out
- Enhanced Logging
- Dynamic Site Activation
- Automatic Certificate Rebind
- ETW Logging
- IIS 10.0
- Version 1607
- Included in Windows Server 2016 and Windows 10 Anniversary Update
- Added:
- HTTP/2 support
- Running IIS on Nano Servers in Windows containers
- New Rest management API and a web-based management GUI
- Wildcard Host Headers
- Version 1709
- Included in Windows Server version 1709 and Windows 10 Fall Creators Update
- Added:
- HSTS support
- Container enhancements
- 4 new server variables
- Site binding PowerShell cmdlets
- Version 1809
- Included in Windows Server 2019 and Windows 10 October Update
- Added:
- Per-site HTTP/2 and OCSP Stapling control flags
- Compression API
- GZIP and brotli support module
- HSTS configuration module
- Version 1607
If you plan on using IIS, try sticking with the latest stable version, as it’s usually the one that has the tightest security and yields the best performance-oriented results, especially if you’re running the latest version of Windows or Windows Server.
How to install IIS?
As we previously stated, you don’t need to install IIS, as it should actually come bundled with your Windows version. If you’re using Windows 10, you should already have some version of IIS 10.0 available on your PC.
However, Microsoft decided not to activate IIS by default, so you’ll need to enable it manually. But don’t worry, it’s not exactly rocket science to get this done. Just follow these steps to activate IIS on your PC:
- Open your Control Panel
- Go to Programs and Features
- Click the Turn Windows features on or off button
- Check the Internet Information Services box
- Click the OK button
Now you may want to restart your PC so that your system can load all required configuration files and let you use IIS to its full extent. It may also work without restarting your PC, but rebooting your system after enabling a new feature is never a bad idea.
You can also enable IIS on your computer by using PowerShell. If you never heard of it, PowerShell is a complex tool that many mistake for CMD. PowerShell is way more complex than that, but we won’t get into too much detail. Without further ado, here’s how you can enable IIS on your Windows PC using PowerShell:
- Launch PowerShell
- Copy and paste the following command in PowerShell:
Enable-WindowsOptionalFeature –online –featurename IIS-WebServerRole
- Wait for the process to come to an end
As you can see, PowerShell hints that no restart is required after enabling IIS on your Windows 10 PC. If you want to rever the process, you can use the following command to disable IIS using PowerShell:
Disable-WindowsOptionalFeature –online –featurename IIS-WebServerRole
However, note that for disabling this feature, even PowerShell recommends that you restart your PC. It’s also possible to restart it later, just don’t start any new projects in the meantime.
How does the IIS server work?
First and foremost, it’s worth noting that IIS has its own process engine that can take care of all client-server requests. Therefore, whenever a client sends a request to your web server, IIS processes that request, generates a reply, and sends it to the client.
From an architectural standpoint, this process unfolds on two different layers:
- Kernel Mode – the code can execute any command, given that it has full access to connected hardware, which is precisely why this mode is used exclusively for trusted processes and why crashes in this mode can bring the whole system down. Last, but not least, HTTP.SYS can be found in Kernel Mode.
- User Mode – commands that are executed in this mode don’t interact directly with hardware or reference memory, but employ APIs to do that for them. This mode offers an additional layer to prevent mishandling of the server and mistakes can be easily undone if necessary.
As we’ve mentioned above, you can find HTTP.SYS in the Kernel Mode. HTTP.SYS is used to forward client requests to an application pool. This request forwarding process is initiated whenever the client interacts with the web site’s URL, attempting to access the page. Whenever this happens, HTTP.SYS retrieves the client’s requests and queues them for specific application pools.
After the forwarding of the request, w3wp.exe (the Worker Process) loads the ISAPI filter and either loads HttpRuntime.ProcessRequest by itself, or in conjunction with aspnet_isapi.dll if it’s an ASPX page. The launch of HttpRuntime.ProcessRequest marks the beginning of the processing, after which the HttpRuntime process uses HttpApplication objects to build a pool, the contents of which will be passed through HTTP.
The HTTP modules are then activated, and this process goes on until the request gets to the ASP.NET page’s HTTP handler. After the request gets through the HTTP route, the page starts to be displayed.
What is the Worker Process?
First of all, it’s worth noting that there’s not only one Worker Process. In fact, there are several such entities that ensure the well-functioning of your web server and the content you host on it, whether it’s websites or applications we’re talking about.
So, IIS’s worker processes are in charge of providing us with the execution environment for all applications and websites you’ve previously configured in the IIS. These processes contain several pieces of information that are crucial to the well-functioning of the aforementioned services.
It’s possible that you can make use of the API to retrieve information regarding memory footprint or CPU utilization. These details can help you keep a close eye on the overall health of your web server and its related worker processes.
Last, but not least, you can use the API to terminate worker processes by simply sending a DELETE request to the worker processes endpoint.
What is the Application Pool?
Although the name is somewhat self-explanatory, the purpose of IIS’s Application Pool is far more complex. First and foremost, the Application Pool contains the worker processes, so it’s safe to say that it plays the role of a container. Furthermore, it isolates applications from each other whether they run on the same server or on separate ones, which is contrary to how a pool usually works.
It’s quite important to know that a single application pool can hold several websites. So, in other words, you can say that an application pool is but a set of URLs that have been handled by worker processes. The separation of applications in these pools is justified by the fact that it could significantly simplify management. More so, it is because of this isolation that, in the event of one application pool failing, the other ones can keep going on as usual.
How to configure an IIS server?
You’ve enabled IIS on your computer and you’ve learned a bit about its components, now let’s see how you can properly configure it so you can run your own web server without significant efforts.
- Press the Win key on your keyboard
- Type PC and right-click the This PC icon
- Select the Manage option from the context menu
- Expand the Services and Applications option
- Select the Internet Information Services box
- Click the Web Sites option
- Right-click the Default Web Site node if the default node hasn’t started for you
As we mentioned a while back, one of the main reasons why people use IIS is for easy web application deployment. IIS and its Advanced Installer feature allow you to configure and deploy web apps on several servers without skipping a beat. You also don’t need to create new configurations for each machine, as IIS can easily take care of that.
If you want to configure a new website, the first thing you’ll want to do is head to the Files and Folders view, where you can manage existing application files or add new ones if you want. Note that you’ll need to place your application files in their individual directory, considering that your website’s admin panel will make use of them later on.
Once you took care of the files, you can move to the IIS Server view, where you can use the New Web Site toolbar to type your new website’s name. What you’ll need to do next is adjust your website’s HTTP/HTTPS settings and consider using SSL for added security. Here’s how you can configure HTTP and SSL for your website or folder:
- Make sure you’re logged on your PC using the Administrator account
- Press the Win key on your keyboard
- Type control and click the Control Panel icon when it appears
- Go to the Administrative Tools section
- Select the Internet Information Services (IIS) Manager
- Choose the website you wish to configure in the left section
- Right-click the website you wish to configure with SSL
- Select Properties from the context menu
- Navigate to the Directory Security tab
- Select the Edit option
- Click the Require Secure-Channel (SSL) option
- Toggle the Require 128-bit encryption option
- Select Accept client certificates to block users without certificates
- Select Ignore client certificates to allow connections regardless of certificates
How can I secure an IIS web server with SSL?
SSL, which is short for Secure Sockets Layer, is still one of the best ways to encrypt communications between you and any target website. Remember a while back that many websites made the leap from HTTP to HTTPS? Well, SSL certificates were and still are an essential part of this process.
the good news is that you can deploy SSL to your website quite easily using IIS. On the other hand, you’ll definitely have to purchase a certificate, since they’re the only way your website can be acknowledged as trustworthy from a data encryption standpoint.
Therefore, the first step would be finding an SSL certificate provider and purchase such an item. After the purchase, you’ll receive either a code or a certificate file. In order to configure SSL with IIS we’ll need the certificate file, so make sure you retrieve it before moving on.
Secure IIS web server with SSL
- Download the certificate file (P7B format) on your PC
- Start the IIS Manager (type inetmgr in the Run utility on your PC)
- Select the server you wish to use from the Connections left-side pane
- Access the Server Certificates option in the central part of the screen
- Click the Complete Certificate Request hyperlink in the right Actions pane
- In the newly-opened window click the … button
- Change the file type from *.cer to *.*
- Navigate to the location where you downloaded the P7B file on your PC
- Double-click your certificate P7B file
- Type a memorable name in the Friendly name field
- Click the OK button once you’ve finished choosing a name
Now you’ve successfully installed a certificate for your IIS server. However, that’s not nearly enough, as you’ll still have to bind the certificate for your website. By the end of it, you’ll have a secure website with a certificate that’s associated with your website, port, and IP address.
Bind security certificate to the website
- Launch the IIS Manager
- Select the website you want to associate with your certificate from the left pane
- Click the Bindings button in the right-hand Actions pane
- Click the Add… button in the newly opened window
- Select HTTPS from the Type combo menu
- Choose either All Unassigned or the website’s IP address from the IP address menu
- Type 443 in the port field
- Select the certificate you installed earlier (it should have the name you chose for it)
- (Optional) Use the View… button to see some details about your certificate
- Toggle the Require Server Name Indication option if you host more than one domain on the same IP address and type a name in the Host name field
- Click the OK button to close the Add Site Binding window
- Close the Site Bindings window
So we’ve managed to install SSL on your IIS web server and associate it with your website. You can use the steps above to associate certificates with more than just one website if the need arises. However, there’s still one thing we need to do: redirect incoming HTTP traffic to HTTPS, to ensure encryption of our visitors’ traffic.
Redirect HTTP to HTTPS
- Visit the official URL Rewrite extension page
- Click the large green Install this extension button
- Launch the executable and complete the installation of URL Rewrite
- Run the IIS Manager
- Select the website you want to redirect traffic for
- Double-click the URL Rewrite icon in the central section of the screen
- Click the Add rules button
- Select Blank rule in the newly opened window (Inbound rules section)
- Type a name that’s easy to remember in the Name field
- Set the Requested URL field to Matches the Pattern
- Choose Regular Expressions in the Using field
- Type
(.*)in the Pattern field - Check the Ignore case option
- Scroll down and expand the Condition section (if needed)
- Choose the Match All option from the Logical grouping menu
- Click the Add button
- Type
{HTTPS}in the Condition input field - Choose Matches the Pattern from the Check if input string menu
- Type
^OFF$in the Pattern field - Check the Ignore case option
- Click the OK button
- Scroll down and expand the Action section (if needed)
- Choose Redirect from the Action type menu
- Type
https://{HTTP_HOST}/{REQUEST_URI}in the Rewrite URL field - Make sure to uncheck the Append query string
- Choose Permanent (301) from the Redirect type menu
- Click the Apply button in the right-hand menu (Actions pane)
That’s it, you’ve now completely implemented SSL on your web server, bound it to your website, and configured the site to redirect incoming HTTP traffic to HTTPS. If done correctly, visitors who try to access your website using HTTP will be automatically redirected to its secure HTTPS counterpart.
What are Virtual Directories?
As we’ve established before, creating and managing a website isn’t the only thing that IIS is capable of doing. You can also create applications, which we already mentioned, but most importantly, you can create virtual directories by simply giving them a name that maps them to a physical directory.
The way this feature works is by letting users access various types of content that are hosted on a server quickly through a direct name. Surely enough, this content could be a website, but it could also be photos, videos, or other types of smaller media files.
Back in the day when IIS 6.0 was all the fuss, virtual applications, and directories were treated as separate objects by IIS. As such, applications consisted of the following elements:
- AppRoot
- AppIsolated
- AppFriendlyName
- AppPoolId
Starting with IIS 7.0, virtual applications and directories are organized within a hierarchy, but they’re still considered to be separate objects. Thus, a website, which is higher in the hierarchy, can contain several applications, or virtual directories that are mapped to a physical location on your PC.
What are log files in IIS?
In IIS log files serve the same purpose they do wherever else you may encounter them. You can use these files to check how things unfolded on your web server, see important events, and, most importantly, understand where things went wrong if any malfunction occurs.
In other words, an IIS log file keeps tabs on everything that happens to your web server, in case you ever need it. A few examples of recorded data include the precise date and time of the events, how much data was transmitted, and the IP addresses related to the events.
Find log files on IIS 7.0 and later
- Hit the Win key on your keyboard
- Type control and select Control Panel
- Double-click the Administrative Tools option
- Launch Internet Information Services (IIS)
- Select your website from the left-hand pane
- Click (or double-click) the Logging icon in the central portion of the screen
- Identify the Directory dialog box at the bottom of the screen
- Click the Browse button to reach the location of IIS log files on your system
Find log files on IIS 6.0 and earlier
- Repeat steps 1-4 from the instructions above
- Right-click your website
- Select Properties from the context menu
- Navigate to the Website tab
- Access the Active Log Format section
- Click the Properties button
- Check the bottom of the screen for the log file directory and names
Can I change ports in IIS?
IIS uses port 80 for all HTTP traffic by default, but that doesn’t mean you can’t change it to another value if you want or need to. Changing to a different port can help you avoid certain firewall-related connectivity issues or dodge attacks that target certain service-port vulnerability combos.
Change default port in IIS
- Launch the IIS Manager
- Right-click your website from the left-hand pane
- Select Properties from the context menu
- Locate the TCP port field
- Type the value of the new port in the TCP port field
Since IIS usually uses port 80 by default, there’s no need to specify it whenever you want to test your website’s functionality, for instance, from inside a browser. You just type your domain name and you should be able to access your website without a hiccup.
However, if you insist on changing the default port, you’ll need to specify it each time you’re trying to access your website from a web browser. You can do that by adding :port number (where port number is the actual port you’re using) at the end of your domain name.
If, for instance, we would change the port of our website to, let’s say 2609, accessing it would look like this: addictivetips.com:2609. Pretty simple, right?
Now if you’re using an older version of Windows, and implicitly an older version of IIS, there are a few things you’ll need to do in a different manner to change the default port.
Change IIS port on Windows 8.1
- Locate the Search Box on your homepage
- Type IIS Manager
- Select Internet Information Services Manager from the search results
- Click the Default Web Site in the left-hand menu
- Select the Bindings option from the right-hand menu
- Highlight http on the main screen
- Click the Edit button
- Type the new value in the Port field
- Click the OK button and close the window
- Select the server node in the left-hand section of the IIS Manager
- Click the Restart Server button in the right-hand sidebar
How can I monitor IIS?
If you’re not exactly a fan of keeping things in order through manual testing and checking log files frequently (we get you), you may want to consider leaning on third-party software solutions that could keep an eye on your IIS web server for you.
SolarWinds Server & Application Monitor
SolarWinds Server & Application Monitor is currently one of the best third-party utilities that can help you monitor your IIS website, server, application, or virtual directory without significant efforts. You just point it to the things you want to keep track of and let it work its magic.
Not only does this tool let you know if your websites and web servers are up and running, but it also provides you with an impressive range of key metrics, including but not limited to CPU, memory & disk usage, and response times.
Furthermore, if there’s something wrong with one of the websites you’re monitoring, SolarWinds Server & Application Monitor can automatically restart it for you in an attempt to fix the issue in a simple manner.
SolarWinds Server & Application Monitor’s screen is split into multiple sections, where you can monitor and analyze your applications and websites, access an overview of your applications’ health status displayed in graph form, and even manage applications at the press of a button.
You can also use this tool to keep track of your SSL certificates‘ expiration dates so that you can always be on top of things when it’s time to renew a soon-to-expire certificate. More so, you can use SolarWinds Server & Application Monitor to manage SSL certificates for several websites or servers for added convenience.
If you’re curious and want to give SolarWinds Server & Application Monitor a try, you’ll be glad to know that there’s a 30-day free trial available, so that you can test run its capabilities before committing to purchasing a license.
What is IIS – Conclusion
To wrap it up, IIS is a handy Microsoft webserver service you can use to create your own server, as well as manage websites, applications, and virtual directories in it without breaking a sweat. It’s currently the second most popular Windows web server in the world, losing first place to Apache HTTP, which is a completely free alternative.
IIS is mainly used to manage commercial websites, which requires you to purchase a commercial license. The price of such a license varies depending on the number of users you plan on having on the website.
Configuring IIS is somewhat intuitive, but you’ll need to be a bit tech-savvy to be able to make out all of its features, understand what each of them does and configure them to get the most out of your web server and associated websites or applications.
