CIS Microsoft IIS 10 Benchmark

IIS should be installed on a dedicated server to reduce attack surface and simplify security management.

Failure to iIS Is Installed on a Dedicated Server may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WindowsFeature Web-Server | Select-Object Name, Installed
# Verify no other major roles (AD DS, DNS, DHCP) are installed

# Install IIS on a dedicated server/VM only

This recommendation verifies that web Content Is on a Non-System Drive on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to web Content Is on a Non-System Drive may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-Website | Select-Object Name, PhysicalPath
# Verify no sites use C:\inetpub\wwwroot

# Move site content to a non-system drive (e.g., D:\WebSites\)
Set-ItemProperty "IIS:\Sites\Default Web Site" -Name physicalPath -Value "D:\WebSites\Default"

the Default IIS Website should be removed from the IIS 10 web server when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining the Default IIS Website when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

Get-Website "Default Web Site" | Select-Object State

Stop-Website "Default Web Site"
Remove-Website "Default Web Site"

This recommendation verifies that only Required IIS Features Are Installed on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to only Required IIS Features Are Installed may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WindowsFeature | Where-Object {$_.Installed -and $_.Name -like "Web-*"} | Select-Object Name

# Remove unneeded features:
Uninstall-WindowsFeature Web-DAV-Publishing
Uninstall-WindowsFeature Web-Ftp-Server

This setting controls whether WebDAV is disabled on the IIS 10 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving WebDAV enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the IIS 10 web server.

Get-WindowsFeature Web-DAV-Publishing | Select-Object Installed

Uninstall-WindowsFeature Web-DAV-Publishing

This recommendation verifies that iSAPI Filters Point to Valid DLLs on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iSAPI Filters Point to Valid DLLs may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT' -filter "system.webServer/isapiFilters" -name "."

# Remove any ISAPI filter entries pointing to non-existent DLLs

This recommendation verifies that anonymous Authentication Is Disabled Where Not Needed on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to anonymous Authentication Is Disabled Where Not Needed may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT' -filter "system.webServer/security/authentication/anonymousAuthentication" -name "enabled"

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/<SiteName>' -filter "system.webServer/security/authentication/anonymousAuthentication" -name "enabled" -value "False"

Basic authentication sends credentials as Base64-encoded plaintext. It must only be used over HTTPS.

Failure to basic Authentication Is Not Used Without TLS may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -pspath 'MACHINE/WEBROOT' -filter "system.webServer/security/authentication/basicAuthentication" -name "enabled"
# Verify TLS is required for any site using Basic auth

# Either disable Basic auth:
Set-WebConfigurationProperty -filter "system.webServer/security/authentication/basicAuthentication" -name "enabled" -value "False"
# Or ensure Require SSL is set on the site

This recommendation verifies that windows Authentication Uses Kerberos on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to windows Authentication Uses Kerberos may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/security/authentication/windowsAuthentication/providers" -name "."

# Ensure Negotiate is listed before NTLM in providers:
# IIS Manager > Site > Authentication > Windows Authentication > Providers
# Move "Negotiate" to the top

This recommendation verifies that maxAllowedContentLength Is Set on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to maxAllowedContentLength Is Set may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering/requestLimits" -name "maxAllowedContentLength"

<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="30000000" />
    </requestFiltering>
  </security>
</system.webServer>

This recommendation addresses the proper configuration of maxUrl and maxQueryString on the IIS 10 web server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of maxUrl and maxQueryString can lead to security gaps that may be exploited by attackers. A properly configured IIS 10 web server reduces exposure to both known vulnerabilities and configuration drift.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering/requestLimits" -name "maxUrl"
Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering/requestLimits" -name "maxQueryString"

<requestLimits maxUrl="4096" maxQueryString="2048" />

Non-ASCII Characters in URLs should not be allowed on the IIS 10 web server. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If Non-ASCII Characters in URLs remains allowed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering" -name "allowHighBitCharacters"

<requestFiltering allowHighBitCharacters="false" />

This recommendation verifies that double-Encoded Requests Are Rejected on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to double-Encoded Requests Are Rejected may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering" -name "allowDoubleEscaping"

<requestFiltering allowDoubleEscaping="false" />

This recommendation verifies that unlisted File Extensions Are Not Served on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to unlisted File Extensions Are Not Served may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering/fileExtensions" -name "allowUnlisted"

<fileExtensions allowUnlisted="false">
  <add fileExtension=".html" allowed="true" />
  <add fileExtension=".css" allowed="true" />
  <add fileExtension=".js" allowed="true" />
  <add fileExtension=".aspx" allowed="true" />
</fileExtensions>

This recommendation verifies that machine Key Validation Method Is AES or SHA256 on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to machine Key Validation Method Is AES or SHA256 may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.web/machineKey" -name "validation"

<system.web>
  <machineKey validation="HMACSHA256" decryption="AES" />
</system.web>

This setting controls whether ViewState MAC Validation is enabled on the IIS 10 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IIS Manager, applicationHost.config, or PowerShell cmdlets.

Without ViewState MAC Validation enabled, the IIS 10 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-WebConfigurationProperty -filter "system.web/pages" -name "enableViewStateMac"

<pages enableViewStateMac="true" />

This recommendation verifies that session State Is Configured with 'cookieless=UseCookies' on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to session State Is Configured with 'cookieless=UseCookies' may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.web/sessionState" -name "cookieless"

<sessionState cookieless="UseCookies" cookieName="ASP.NET_SessionId" />

This recommendation verifies that session Cookie Is HttpOnly on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to session Cookie Is HttpOnly may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.web/httpCookies" -name "httpOnlyCookies"

<httpCookies httpOnlyCookies="true" requireSSL="true" />

This recommendation configures the timeout for Session on the IIS 10 web server. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to session Timeout Is ≤ 20 Minutes may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.web/sessionState" -name "timeout"

<sessionState timeout="20" />

This setting controls whether SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1 is disabled on the IIS 10 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1 enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the IIS 10 web server.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server" -Name "Enabled" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "Enabled" -ErrorAction SilentlyContinue
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Name "Enabled" -ErrorAction SilentlyContinue

# Disable legacy protocols via registry:
New-Item "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Force
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "Enabled" -Value 0 -Type DWord
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Name "DisabledByDefault" -Value 1 -Type DWord
# Repeat for SSL 2.0, SSL 3.0, TLS 1.1

This setting controls whether TLS 1.2 and/or TLS 1.3 is enabled on the IIS 10 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IIS Manager, applicationHost.config, or PowerShell cmdlets.

Without TLS 1.2 and/or TLS 1.3 enabled, the IIS 10 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Name "Enabled" -ErrorAction SilentlyContinue

New-Item "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Force
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Name "Enabled" -Value 1 -Type DWord

This setting controls whether Weak Cipher Suites is disabled on the IIS 10 web server. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Weak Cipher Suites enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the IIS 10 web server.

# Check cipher suite order:
Get-TlsCipherSuite | Select-Object Name

Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_128_CBC_SHA"
Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_256_CBC_SHA"
Disable-TlsCipherSuite -Name "TLS_RSA_WITH_3DES_EDE_CBC_SHA"
# Keep only ECDHE and AES-GCM based suites

This setting controls whether HSTS is enabled on the IIS 10 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IIS Manager, applicationHost.config, or PowerShell cmdlets.

Without HSTS enabled, the IIS 10 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-WebConfigurationProperty -filter "system.webServer/httpProtocol/customHeaders" -name "." | Where-Object {$_.name -eq "Strict-Transport-Security"}

# IIS 10+ native HSTS:
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -location '<SiteName>' -filter "system.webServer/hsts" -name "enabled" -value "True"
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -location '<SiteName>' -filter "system.webServer/hsts" -name "max-age" -value "31536000"
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -location '<SiteName>' -filter "system.webServer/hsts" -name "includeSubDomains" -value "True"

This recommendation addresses the proper configuration of HTTP to HTTPS Redirect on the IIS 10 web server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of HTTP to HTTPS Redirect can lead to security gaps that may be exploited by attackers. A properly configured IIS 10 web server reduces exposure to both known vulnerabilities and configuration drift.

# Check URL Rewrite rules:
Get-WebConfiguration -filter "system.webServer/rewrite/rules" -PSPath 'IIS:\Sites\<SiteName>'

<rewrite>
  <rules>
    <rule name="HTTP to HTTPS" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
    </rule>
  </rules>
</rewrite>

This recommendation verifies that iIS Logging Is Enabled for All Sites on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iIS Logging Is Enabled for All Sites may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-Website | ForEach-Object { Get-WebConfigurationProperty -pspath "IIS:\Sites\$($_.Name)" -filter "system.webServer/httpLogging" -name "dontLog" }

Set-WebConfigurationProperty -filter "system.webServer/httpLogging" -name "dontLog" -value "False"

This recommendation verifies that w3C Log Format Is Used on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to w3C Log Format Is Used may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logFormat"

Set-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logFormat" -value "W3C"

This recommendation verifies that log Fields Include All Essential Fields on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to log Fields Include All Essential Fields may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logExtFileFlags"

# Ensure at minimum: Date, Time, ClientIP, UserName, Method, UriStem, UriQuery, HttpStatus, Win32Status, TimeTaken, ServerIP, UserAgent, Referer
Set-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logExtFileFlags" -value "Date,Time,ClientIP,UserName,Method,UriStem,UriQuery,HttpStatus,Win32Status,TimeTaken,ServerIP,UserAgent,Referer"

This setting controls whether ETW Logging is enabled on the IIS 10 web server. Enabling this feature strengthens the security posture by enforcing the recommended configuration via IIS Manager, applicationHost.config, or PowerShell cmdlets.

Without ETW Logging enabled, the IIS 10 web server may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

Get-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logTargetW3C"

Set-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "logTargetW3C" -value "File,ETW"

This recommendation verifies that logs Are Stored on a Non-System Partition on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to logs Are Stored on a Non-System Partition may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "directory"

Set-WebConfigurationProperty -filter "system.applicationHost/sites/siteDefaults/logFile" -name "directory" -value "D:\IISLogs"

This recommendation verifies that application Pool Identity Is 'ApplicationPoolIdentity' on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to application Pool Identity Is 'ApplicationPoolIdentity' may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/processModel" -name "identityType"

Set-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/processModel" -name "identityType" -value "ApplicationPoolIdentity"

This recommendation verifies that each Site Has Its Own Application Pool on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to each Site Has Its Own Application Pool may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-Website | Select-Object Name, ApplicationPool | Group-Object ApplicationPool | Where-Object {$_.Count -gt 1}

# Create dedicated app pools:
New-WebAppPool -Name "SiteName_Pool"
Set-ItemProperty "IIS:\Sites\SiteName" -Name applicationPool -Value "SiteName_Pool"

This recommendation configures the interval for Regular Recycling on the IIS 10 web server. Appropriate interval values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to regular Recycling Interval Is Set may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/recycling/periodicRestart" -name "time"

Set-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/recycling/periodicRestart" -name "time" -value "29:00:00"

This recommendation addresses the proper configuration of Virtual Memory Limit on the IIS 10 web server. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Virtual Memory Limit can lead to security gaps that may be exploited by attackers. A properly configured IIS 10 web server reduces exposure to both known vulnerabilities and configuration drift.

Get-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/recycling/periodicRestart" -name "memory"

Set-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/recycling/periodicRestart" -name "memory" -value "4194304"

This recommendation configures the timeout for Idle on the IIS 10 web server. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to idle Timeout Is ≤ 20 Minutes may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/processModel" -name "idleTimeout"

Set-WebConfigurationProperty -filter "system.applicationHost/applicationPools/applicationPoolDefaults/processModel" -name "idleTimeout" -value "00:20:00"

This recommendation configures X-Content-Type-Options to 'nosniff' on the IIS 10 web server. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for X-Content-Type-Options could weaken security controls or allow unintended behavior. Setting this to 'nosniff' ensures the IIS 10 web server operates within a well-defined security boundary.

Get-WebConfigurationProperty -filter "system.webServer/httpProtocol/customHeaders" -name "." | Where-Object {$_.name -eq "X-Content-Type-Options"}

Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name='X-Content-Type-Options';value='nosniff'}

This recommendation verifies that x-Frame-Options Is Set on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to x-Frame-Options Is Set may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/httpProtocol/customHeaders" -name "." | Where-Object {$_.name -eq "X-Frame-Options"}

Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name='X-Frame-Options';value='SAMEORIGIN'}

This recommendation verifies that content-Security-Policy Header Is Set on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to content-Security-Policy Header Is Set may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check response headers:
Invoke-WebRequest https://<site> | Select-Object -ExpandProperty Headers | Select-String "Content-Security-Policy"

Add-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/httpProtocol/customHeaders" -name "." -value @{name='Content-Security-Policy';value="default-src 'self'"}

the 'Server' Header should be removed from the IIS 10 web server when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining the 'Server' Header when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

Get-WebConfigurationProperty -filter "system.webServer/security/requestFiltering" -name "removeServerHeader"

Set-WebConfigurationProperty -filter "system.webServer/security/requestFiltering" -name "removeServerHeader" -value "True"

This recommendation verifies that detailed Errors Are Not Sent to Clients on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to detailed Errors Are Not Sent to Clients may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/httpErrors" -name "errorMode"

Set-WebConfigurationProperty -filter "system.webServer/httpErrors" -name "errorMode" -value "DetailedLocalOnly"

This recommendation verifies that custom Error Pages Are Configured for Common Errors on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to custom Error Pages Are Configured for Common Errors may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.webServer/httpErrors/error" -name "."

<httpErrors errorMode="DetailedLocalOnly">
  <remove statusCode="404" />
  <error statusCode="404" path="/errors/404.html" responseMode="ExecuteURL" />
  <remove statusCode="500" />
  <error statusCode="500" path="/errors/500.html" responseMode="ExecuteURL" />
</httpErrors>

This recommendation verifies that aSP.NET Custom Errors Mode Is 'On' or 'RemoteOnly' on the IIS 10 web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aSP.NET Custom Errors Mode Is 'On' or 'RemoteOnly' may leave the IIS 10 web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-WebConfigurationProperty -filter "system.web/customErrors" -name "mode"

<customErrors mode="RemoteOnly" defaultRedirect="/errors/generic.html" />