Microsoft IIS, short for Internet Information Services, is the web server built into Windows and Windows Server that hosts websites, web applications and APIs over HTTP and HTTPS. Among web servers it is the standard platform for ASP.NET and other .NET applications in Windows environments, and it also serves static content, PHP through FastCGI and reverse proxy workloads.
IIS is a Windows component rather than a separately sold product: its version follows the operating system, with IIS 10 shipping in Windows Server 2016, 2019, 2022 and 2025. It is managed through IIS Manager, PowerShell and XML configuration files, and it integrates closely with Active Directory, Windows authentication and the Windows security model.
How Microsoft IIS processes requests
IIS splits request handling between the Windows kernel and user-mode worker processes. The kernel-mode driver HTTP.sys listens on network ports, parses incoming requests, serves cached responses directly from kernel mode, and places other requests in a queue for the right application pool.
Each application pool runs one or more w3wp.exe worker processes under its own identity. The Windows Process Activation Service (WAS) starts, monitors and recycles these workers, so a crash or memory leak in one application does not take down the others. Inside the worker, a modular integrated pipeline passes each request through authentication, authorization, caching, logging and the handler that produces the response.
| Component | Runs in | Role |
|---|---|---|
| HTTP.sys | Kernel mode | Accepts connections, queues requests, kernel caching |
| WAS | Service | Manages application pool lifecycles |
| W3SVC | Service | Configures HTTP.sys from site bindings |
| w3wp.exe | Worker process | Executes the request pipeline and application code |
| applicationHost.config | Configuration file | Server-wide sites, pools and module settings |
| web.config | Site or folder | Per-application settings that override defaults |
Application pools and configuration
An application pool is the isolation boundary of IIS. It defines the process identity, the .NET CLR version or No Managed Code for modern ASP.NET Core, the 32-bit or 64-bit mode and the recycling rules. By default, IIS recycles a pool every 1,740 minutes, or 29 hours, which spreads restarts across the day but can cause unexpected cold starts.
| Setting | Default | Practical guidance |
|---|---|---|
| Identity | ApplicationPoolIdentity | Keep the virtual account and grant only needed rights |
| Pipeline mode | Integrated | Use Classic only for legacy applications |
| Regular recycling interval | 1,740 minutes | Schedule recycling at quiet hours instead |
| Idle timeout | 20 minutes | Disable or extend for applications with slow startup |
| Start mode | OnDemand | AlwaysRunning with preload avoids first-request delays |
| Rapid-fail protection | 5 failures in 5 minutes | Stops a crashing pool and returns 503 errors |
Configuration is hierarchical. Server-wide values live in applicationHost.config, and each site or folder can override permitted sections in its own web.config, much as .htaccess works in Apache, though IIS reads web.config changes and restarts the affected application rather than reading files on every request.
IIS compared with other web servers
IIS competes mainly with Nginx and Apache, and the choice usually follows the operating system and the application stack rather than raw performance.
| Property | Microsoft IIS | Nginx | Apache |
|---|---|---|---|
| Platform | Windows only | Linux, BSD, Windows | Linux, BSD, Windows |
| Request model | Kernel queue with worker pools | Event-driven workers | Multi-processing modules |
| Per-folder overrides | web.config | Not supported | .htaccess |
| Native strength | ASP.NET and Windows authentication | Static files and reverse proxy | Module ecosystem and flexibility |
| Licensing | Included with Windows | Open source | Open source |
ASP.NET Core applications run on IIS through the ASP.NET Core Module, either in-process inside w3wp.exe, which is faster, or out-of-process with the Kestrel server behind IIS acting as a reverse proxy. With the optional URL Rewrite and Application Request Routing extensions, IIS can also serve as a reverse proxy and load balancer in front of other servers.
Hosting PHP and other stacks on IIS
IIS is not limited to .NET. PHP runs through the FastCGI module, which keeps a pool of php-cgi.exe processes alive and passes requests to them, avoiding the cost of starting an interpreter for every page. Settings such as the maximum number of instances and the number of requests per process before recycling control stability and memory use.
Content management systems written in PHP work on IIS, but rewrite rules written for Apache must be translated into URL Rewrite rules in web.config, and file permissions follow Windows ACLs rather than Unix modes. Python and Node.js applications are usually run as separate services behind IIS, with HttpPlatformHandler or Application Request Routing forwarding requests to them. In practice, most organizations choose IIS for these stacks only when a Windows server is already required for other reasons.
Security and operational practice
IIS is installed with a minimal set of role services, and adding only the features an application needs keeps the attack surface small. Every installed module, such as WebDAV or CGI, is another component that must be patched and configured.
- Bind HTTPS certificates with Server Name Indication so that several sites share one address securely.
- Disable legacy TLS versions and weak cipher suites at the Windows Schannel level.
- Remove the Server header and detailed errors so that responses reveal less about the platform.
- Use request filtering to limit request sizes, block file extensions and deny hidden segments.
- Ship logs centrally, since W3C log files stay on the server by default and grow without limit.
Typical errors carry HTTP substatus codes that point to the cause: 500.19 signals an invalid configuration file, 503 a stopped or failing application pool, and 401.2 an authentication method that the client and server do not share. The substatus appears in the IIS log, which makes it the first place to look.
The short version
Microsoft IIS is the program that lets a Windows server deliver websites to browsers. When someone opens a page, IIS receives the request, hands it to the right application and sends the page back.
Each website can run in its own separate compartment. If one site has a problem, the others keep working. Companies that build their software with Microsoft tools often choose IIS because it fits naturally into their Windows systems.
Where it makes a difference
A hospital’s IT department runs an internal staff portal written in ASP.NET Core on Windows Server 2022. Staff sign in automatically with their Windows domain accounts through Integrated Windows Authentication, so no separate password is needed.
Users report that the first page each morning takes almost a minute to load. The administrators find that the application pool shuts down after the default 20-minute idle timeout overnight and that the warm-up of the application is slow. They set the pool to AlwaysRunning with preload enabled and move recycling to 3:00 a.m. As a result, the morning delay disappears, while nightly recycling still clears memory growth before the day shift begins.