Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I ensure website isolation in a shared environment on IIS 7 ?

basically I host multiple websites and I do not want one getting hacked, ending up in all getting hacked.

anyways I can ensure this?

share|improve this question

Web site isolation in a shared hosting environment is consistent with all general security isolation recommendations for Internet Information Services 7 (IIS7). In particular, it is recommended to:

  • Use one application pool per Web site.
  • Use a dedicated user account as an identity for the application pool.
  • Configure anonymous user identity to use the application pool identity.
  • Ensure that FastCGI impersonation is enabled in the Php.ini file.
share|improve this answer

This article talks about setting up isolated application pools, which will do what you want. The best way to protect multiple websites is to run each website under a different identity with the lowest required privileges (IE: same privileges as the Network Service account). That way you can use standard file permissions and group policy to restrict access for each user individually. Many hosting control panels such as Plesk and cPanel will use this sort of permissions model to make sure the system is secure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.