Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm deploying a simple ASP.NET application on IIS 7.5 and I'd like to know what changes I should make or configurations I should check to protect my server.

Will the default settings be secure enough? I'm very much a beginner when it comes to server management so any tips will be very helpful.

share|improve this question
up vote 1 down vote accepted

1.) make sure you're behind a firewall that blocks all ports except what you need.
2.) Keep your patches up to date.
3.) Remove any services you're not using, including FTP. If you're using FTP, stop, and use something secure like ssh.

Besides that, its pretty secure. Set up your firewall to allow you to access the server remotely only(with SSH or RDP) from set IP addresses.

share|improve this answer

Only allow port 80 through in your "Windows Firewall with Advanced Security" - Start - Administrative Tools - Windows Firewall with Advanced Security - Add 443 is https.

Windows 2008 R2 (IIS 7.5) are pretty secure out of the box.

If you need to use FTP make sure you have ip restrictions.

The old attack surfaces like webdav / frontpage extensions, etc. are an exploit of the past.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.