Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to put a website on windows server IIS, i'd like to use basic authentification like i'd do with Apache, with the .htaccess / .htpasswd

I read here & there, that i could do this through the admin tabs of IIS, but i'm not the administrator, and i only have ftp access. It seems to be a 'web.config' file where i could do this.

Is there a way to set up such things within a config file ?

I'm not used to work with IIS...

share|improve this question

This depends. Typically this isn't delegated the same way as Apache does. However if you are looking to password protect your site and you're using ASP.NET, you can do this with the authentication and authorization elements. This is set in web.config. To research and get up to speed, do a google/bing search for "authentication authorization".

Additionally, if you are using IIS7, then you can set this in <system.webServer> which will apply to all file types.

If you need to change the authentication type from windows to basic, that's something different again, and will require the server administrator or a control panel to help with that, but I suspect that it's just password protection that you need.

Here's an example that may be what you need:

Assuming that you're using and you want to password protect your site, create a file called web.config in the root of the site and place the following in it:

    <authentication mode="Windows">
      <allow users="?" />
share|improve this answer
(Un)fortunatly i don't use ASP.NET, it's php based website. I don't "really" want to do an authentifaction system, but just protect the application during testing on the production server... – Boris Guéry Oct 29 '09 at 12:31
It's been years since I've used PHP so I'm not sure if it has built-in authentication or not. If it does, you could use that. If not, if it's IIS7, you can password protect using system.webServer in a similar way to the code example above. Otherwise, you'll need to talk with whoever hosts to server so that they can set the authentication level for you. – Scott Forsyth - MVP Oct 29 '09 at 22:16

Wouldn't Scott's method work regardless of if the app is ASP.NET or not? IIS will be looking for a web.config to override its defaults anyway and it likely wouldn't care what type of content you're serving until after that. There's nothing in the code that is required to implement that web.config - it's just telling IIS what you want done on the authentication/authorization level.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.