Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Forgive my lack of IIS experience, but I have a user on a hosted server running IIS with Plesk. He uses protected folders, and I'm looking for a way to:

  1. Allow him to protect folders using a simple username/password combo
  2. Whitelist a static IP so the folder can always be accessed without auth from that server

It doesn't have to—and preferably wouldn't be—a Plesk-only solution. If there's a way to do it through web.config that would be even better.

I'm basically looking for the IIS equivalent of an Apache htaccess/htpasswd auth :)


share|improve this question
BTW, whic version of Windows server/IIS is this? – uSlackr Mar 1 '12 at 14:00
Off the top of my head, I'm not sure, but I was hoping for a solution that would be generic enough to suggest to other IIS users who may have the same problem. I'm beginning to think there's no silver bullet for this one. – Aksival Mar 1 '12 at 19:01

There may be another way, but simply you can
- create a local user under Windows,
- add them to a local user group,
- remove anonymous access to the folder containing the web site and
- change file permissions to only allow access to members of the local user group

For the IP whitelist, there doesn't appear to be a way to override basic auth by IP address.

Its a bit of a kludge, but you could point a separate virtual site to the same directory and lock it down to nothing other than the local IP. Perhaps use host header to select the new site

share|improve this answer
How would this allow a specific IP to connect? – Aksival Mar 1 '12 at 0:32
I updated my answer – uSlackr Mar 1 '12 at 14:27

I believe that's the tool you're looking for, @Aksival:

I'm not sure if it'll provide a whitelist for a static ip (I think not), but it definitely allows you to setup authentication for specific directories served by IIS.

share|improve this answer
The whitelisting is critical, as the user can already protect folders through his Plesk interface. – Aksival Mar 1 '12 at 0:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.