what is the best way to secure web server on Windows?

Answer 1

If you are not running a web server on Windows Server software that is huge mistake number one.

The best way to secure a web server is knowing a "IIS Internet Information Services" like the back of your hand and using Microsoft Threats and Countermeasures guide for Servers. This will explain a lot of configurations and give you better references for more research.

Also that web-server needs to be in a DMZ so intruders who bust into the server and it will happen, are isolated and cannot communicate with machines that administer the server.

Anyone asking this question here, needs to be very cautious of taking advice from some novice who has never been a webmaster or interacted with them on a daily to day basis doing Security testing and evaluation.

Highly Concerned,
Network Security Engineer

Answer 2

One company (pocket.com) has used a really unusual way for securing their web-server: they've put an MS-DOS OS on it and an ancient HTTP Carnegie server. The thing is still running in 2014, since there's nobody around who remembers how to hack such a configuration:)

Answer 3

2

Answer 4

By secure you mean what?

1. Place the web server behind any firewall so that only port 80 is open (web server/http).

2. Use VERY strong password or phasphrases for admin accounts.

3. Use an antivirus program.

4. Keep it updated via MS.

5. Keep a good backup and assume it will get hacked.

Answer 5

Dude, you can get a cheap Dlink DI-524 Hardware Router for under $20 USD (US Dollars :P) from any rretailer like K-Mart, Best Buy or on eBay, and I recommend if your going to run a web server, use Linux (Ubuntu Gentoo or Debian) or use FreeBSD.

Answer 6

This is a long answer but in short:

Place a firewall (hardware appliance would be best) in front of it and open up only the needed ports.

This should protect from external threats.

Answer 7

use Firefox... not Explorer... it's not from Microsoft..