How to configure IIS using the web.config XML file

Configuring IIS can be achieved through the web.config file, which supports custom error pages, URL rewriting, authentication and authorization, MIME type settings and request filtering; the correctly named web.config file needs to be placed in the application root directory and takes effect in the integrated pipeline mode. All configurations are written in XML format and follow the IIS architecture. After modification, direct deployment does not require server permissions, but the syntax must be ensured to avoid 500 errors.

Configuring IIS (Internet Information Services) through the web.config file is a powerful way to manage settings directly within your web application without needing server-level access. The web.config file uses XML syntax and allows you to control behaviors like URL rewriting, authentication, error handling, MIME types, and more—all at the application or subdirectory level.

Enable and Use web.config in IIS

The web.config file should be placed in the root directory of your website or application. IIS automatically reads and applies its settings when the file is present. Make sure:

• Your site is running under an Application Pool using Integrated Pipeline mode.
• The file is named exactly web.config (case-sensitive on some systems).
• You have proper permissions to modify files in the site directory.

Common Configuration Examples

Handle HTTP errors with custom pages:

 <configuration>
  <system.webserver>
    <httperrors errormode="Custom">
      <remove statuscode="404"></remove>
      <error statuscode="404" path="/errors/notfound.html" responsemode="ExecuteURL"></error>
    </httperrors>
  </system.webserver>
</configuration>

Use the URL Rewrite module to redirect or rewrite URLs:

 <configuration>
  <system.webserver>
    <rewrite>
      <rules>
        <rule name="Redirect to HTTPS" stopprocessing="true">
          <match url="(.*)"></match>
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$"></add>
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirecttype="Permanent"></action>
        </rule>
      </rules>
    </rewrite>
  </system.webserver>
</configuration>

Set access rules for users or roles:

 <configuration>
  <system.web>
    <authentication mode="Windows"></authentication>
  </system.web>
  <system.webserver>
    <security>
      <authorization>
        <add accesstype="Allow" roles="DOMAIN\Users"></add>
        <add accesstype="Deny" users="?"></add>
      </authorization>
    </security>
  </system.webserver>
</configuration>

Ensure IIS serves unknown file types correctly:

 <configuration>
  <system.webserver>
    <staticcontent>
      <mimemap fileextension=".json" mimetype="application/json"></mimemap>
      <mimemap fileextension=".woff" mimetype="application/font-woff"></mimemap>
    </staticcontent>
  </system.webserver>
</configuration>

Block specific file extensions or URLs:

 <configuration>
  <system.webserver>
    <security>
      <requestfiltering>
        <fileextensions>
          <add fileextension=".config" allowed="false"></add>
        </fileextensions>
      <requestfiltering>
    </requestfiltering></requestfiltering></security>
  </system.webserver>
</configuration>

Most configurations go inside the section, which controls IIS-specific features in Integrated mode. Settings in affect ASP.NET behavior but may not influence all IIS modules.

After making changes, test by accessing your site. If misconfigured, IIS may return a 500 error—double-check XML syntax and nesting.

Basically just structure your web.config with correct XML and known IIS schema elements. It's flexible, deployable with code, and doesn't require admin tools.

The above is the detailed content of How to configure IIS using the web.config XML file. For more information, please follow other related articles on the PHP Chinese website!