IIS in depth: site bindings, application pools and URL Rewrite

Internet Information Services (IIS) is the web server built into Windows Server. It runs ASP.NET and .NET apps natively and can also host PHP and static sites. Once IIS is installed, three concepts decide how well it works: bindings (how requests reach a site), application pools (how sites are isolated) and URL Rewrite (how URLs are redirected and rewritten).

Before you start

• A Windows VPS with IIS installed: install IIS and host a website.
• RDP access as an administrator: connect to a Windows VPS.

Site bindings

A binding is a combination of protocol, IP, port and host name. IIS picks the site whose binding matches the incoming request.

1. Open IIS Manager → Sites → your site → Bindings…
2. Add http, IP All Unassigned, port 80, host name example.com. Add another for www.example.com.
3. Add https, port 443, host name example.com, tick Require Server Name Indication, and pick the certificate.

With SNI, many HTTPS sites share one IP, each with its own certificate. Leave one site without a host name only if you want a default catch-all site.

Free SSL certificates on IIS

IIS has no built-in ACME client. A widely used free tool is win-acme (wacs.exe): it reads your bindings, requests Let's Encrypt certificates, installs them into the Windows certificate store, updates the HTTPS bindings and creates a scheduled task for renewal.

Application pools

Each application pool is a separate w3wp.exe worker process with its own identity. Give every site its own pool so a crash, memory leak or compromise in one cannot affect the others.

• .NET CLR version: No Managed Code for ASP.NET Core, PHP and static sites; v4.0 for classic ASP.NET Framework apps.
• Identity: the default ApplicationPoolIdentity creates a virtual account IIS AppPool\PoolName. Grant it NTFS read access to the site folder (and modify only on upload or cache folders).
• Recycling: by default pools recycle every 1,740 minutes (29 hours). Schedule recycling at a quiet time instead under Advanced Settings → Recycling.
• Idle Time-out: 20 minutes by default; the first visit after that is slow. Set it to 0 and Start Mode to AlwaysRunning for busy sites.
• Rapid-Fail Protection: stops a pool that crashes repeatedly, which shows as 503 Service Unavailable.

Run PHP on IIS

1. Install the CGI role feature (Server Manager → Web Server → Application Development → CGI). This provides FastCGI.
2. Download the Non Thread Safe x64 PHP build from windows.php.net and extract it to C:\PHP. Install the matching Visual C++ runtime.
3. In IIS Manager → server → Handler Mappings → Add Module Mapping: request path *.php, module FastCgiModule, executable C:\PHP\php-cgi.exe.
4. Add index.php under Default Document.
5. Tune FastCGI under FastCGI Settings: set PHP_FCGI_MAX_REQUESTS and an instance count that fits your RAM.

URL Rewrite

Install the URL Rewrite module (free from Microsoft). Rules live in each site's web.config, which plays the role of .htaccess.

Force HTTPS

<rule name="Force HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions><add input="{HTTPS}" pattern="off" /></conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>

Front controller (WordPress, Laravel)

<rule name="Front controller" stopProcessing="true">
  <match url=".*" />
  <conditions>
    <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
    <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
  </conditions>
  <action type="Rewrite" url="index.php" />
</rule>

Both rules go inside <system.webServer><rewrite><rules>. IIS Manager can also import Apache mod_rewrite rules and convert them for you (URL Rewrite → Import Rules).

Logs

IIS writes W3C-format logs to C:\inetpub\logs\LogFiles\W3SVC<siteID>. The sub-status in log lines (e.g. 404.0, 500.19) pinpoints the exact error.

Troubleshooting

• HTTP 500.19: invalid web.config or a module it references (often URL Rewrite) is not installed.
• 503 Service Unavailable: the app pool stopped; check Event Viewer for the crash reason.
• 401/403 on static files: the pool identity lacks NTFS read permission.
• Wrong site answers: overlapping bindings; check host names on each.

FAQ: IIS

Can IIS host PHP as well as Linux servers?

It works well for many apps, but PHP software is mostly tested on Linux; prefer a Linux server unless you need Windows.

Is web.config like .htaccess?

Yes, per-directory config, but in XML.

Should each site have its own application pool?

Yes, for isolation and easier troubleshooting.

Next steps

• Windows VPS performance troubleshooting
• Linux vs Windows server hosting
• Windows Server backup with wbadmin