The site isn't going to be dealing with thousands of hits or anything - maybe a couple of dozen hits a day at best. If that situation should start to change, he'll get a professional involved. :-)
He's got Win 2003, service-packed up to date, and it now has IIS 6 on there. I know almost nothing about IIS. I've got it up and running for him, but before I configure his router to direct incoming web traffic to the server, I just want to check that I've done all the obvious, reasonable things to secure the site as best as I can.
Is there anything 'out of the box' that I can turn-off, given that the website really is just a half-dozen static HTML files? Should I still be using IIS6 (though I gather you can't run IIS7 on Windows 2003)?
Any advice gratefully received!