Category: Windows

So you’ve discovered to your absolute horror that the WordPress site your company has inherited is running on Windows… on IIS?

Before you stand up, throw your computer chair out the Window, maliciously eat your co-workers salad and enjoy it, or drop all the production databases, relax. We’ve got you covered.

🤷 What’s the problem?

Good point. IIS (Information Internet Services) is the home-grown proprietary (for now) web server provided by Microsoft for Windows customers. IIS is fantastic at what it does, and can serve as an efficient web host as well as an absolutely golden reverse proxy server.

So what’s the problem?

🙅🏾 Support

Zilch. Nada. No dice. WordPress is absolutely not designed to be run on IIS and probably never will be. This doesn’t mean your server is going to burst into flames when you run the site, but means that when support is needed you can be damn well sure your first bit of advice will be “don’t use Windows”.

So don’t use IIS? Simple?

Except that currently NGINX is crippled on Windows (source), and Apache, which is thankfully available on Windows via unofficial channels… But you still have very little support since it operates differently being on Windows.

However, WordPress requirements state:

We recommend Apache or Nginx as the most robust and featureful server for running WordPress, but any server that supports PHP and MySQL will do.

– so don’t lose hope just yet.

📂 The web.config File

If you’re coming from an Apache background, you might be used to a .htaccess file. Just like how .htaccess is not compatible with NGINX, it is also not compatible with IIS.

For each folder of importance to IIS, a web.config file will appear in the directory. This tells IIS what fancy features and involvement the folder has with web capabilities. It will store everything configuration-wise, so do be careful not to delete or corrupt this file.

web.config is an XML file, and can be easily edited in an editor of your choice. Once you get very comfortable with IIS, you’ll find yourself editing the file manually more often than using the GUI console. This will also to reduce the management overhead of changing IIS settings.

An example of useful properties stored in here are:

• Priority list of the default index to load.
• URL rewrite/redirect rules.
• Request filtering, blocking and setting adjustments.
• Directory over-riding of parential settings (e.g. PHP Version).

⚙️ Setting up WordPress

First you will need a database. It is recommended you have the database on a different server for performance and security reasons, but you can also have MySQL running on the same server as IIS.

MySQL runs well on Windows, and is very well supported. You shouldn’t expect much push-back in the way of configuring MySQL. However, if you wish to use Microsoft SQL Server, you may wish to check out Project Nami.

Once completed, setup a database and access user like you would a Linux-based setup installation.

Also, while it’s best to always be running the latest version of Windows Server, please consider using a version no later than IIS 10 (Windows Server 2016). This is because older versions of IIS do not have support for HTTP/2. Technically speaking the minimum requirement is IIS 7 (Windows Server 2008).

🐘 PHP on Windows/IIS

Prerequisites

You will need to configure IIS to use CGI processing for IIS (which isn’t enabled on default IIS installations).

You also need the URL Rewriting module for IIS, unless you are planning on using those super ugly index.php URLs.

PHP is fully supported on Windows. To download PHP, visit their website at windows.php.net. You will also need the C++ Redist 2019 which is found on the sidebar on their website downloads.

This guide will use FastCGI, which will require a Non-thread safe version (NTS) of PHP. Typically the first download listed in each PHP version on their site will be the ideal version for IIS.

Download the correct zip file and extract it to a place of your choice on your server (Program Files is acceptable). My choice is normally C:\PHP\X.X.X (version number).

If you’re planning on running any PHP tools such as WP-CLI, it would also be a good idea to add the above path to your system Path environmental variable.

To do so, open Run (Win key + R), and run rundll32 sysdm.cpl,EditEnvironmentVariables. Append the path to Path found under System variables.

Installing WP-CLI (optional)

Now is a good time to install WordPress CLI if you’re planning on using it. They provide a fantastic guide to setting up WP-CLI on Windows.

Web Platform Installer – Easy

Windows Server has an optional comonent called the Web Platform Installer. This neat application provides a collection of the most well-known and loved software packages, and provides super-easy methods of installing them. Guess what, WordPress included! You just need to install IIS with CGI first.

Create a Site as regular, and double-click on it. You should have an option in Management called Web Platform Installer (at time of writing, it’s a circular, orange download icon). Open this up, and a new panel will load up. Search for WordPress, click Add, then Install.

❓ No Web Platform Installer? It’s not installed by default. Click your server name in the Connections left-hand panel. In the now-visible right-hand panel, click on Get New Web Platform Components. Follow the Microsoft instructions and you’ll have the aforementioned button.

Now for configurations, you should generally always separate up your servers (e.g. web and database are separate). But sometimes, you just want a get going quickly on a development site. This installer has a neat trick. If you do not have a database server, and the current machine doesn’t have MySQL installed, it will create a MySQL server instance for you!

If done correctly, you should be at this screen. It will by default try to create localhost/wordpress. Make sure you’ve got the right Web Site selected, and – if desired – the right subfolder configuration. If something is wrong, it will need to be changed manually afterwards.

Hit Continue, and go grab a coffee. When you return, WordPress is installed! Easy as that, you’ve got your first WordPress installation.

For the technical information:

• Microsoft WebMatrix is installed.
• ❗ PHP 7.1 is installed via IIS Express.
  • A newer version of PHP is recommended.
• A global FastCGIModule for PHP is created.
  • This means all sites on your IIS server can run PHP code via this module. Change priority listings if you wish to run different versions.
  • You can use the PHP Manager or manual process to over-ride this.
• MySQL 5.1 is installed, if no external database was provided.

PHP Manager IIS Plugin – Intermediate

There is a plugin for IIS called PHP Manager, which is able to do most of the heavy-lifting for you in configuring PHP. This will enable you to register new PHP versions, adjust plugins, edit configurations and even split containers to different IIS versions as simply as possible via GUI.

Simply download their extension and install it on your server. When you next run IIS you will find a new PHP module on the snap-in.

You can register a parent PHP version and it will affect all children sites. If you register an alternative version on a child site, it will over-ride the parent and so on, in a hierarchical manner. Multi-version PHP, hooray a benefit!

PHP Manually – Advanced

If you opt not to go for IIS manager (not a fan of community IIS modules), then you can still go ahead configuring PHP manually to the IIS container.

First you need to tell the FastCGI system about your PHP installation.

• Open IIS.
• Click on the root server (just below Start Page on the left pane).
• Open FastCGI Settings.
• On the right hand side, click on Add Application…
• In Full Path, navigate to php-cgi.exe in your extracted php setup.
• In Monitor changes to file, set this to your php.ini file.
• Click on … on the end of the row named Environmental Variables.
• Click Add.
• Add PHPRC variable with the value of the PHP installation path, where your PHP-CGI file was above.
• Create another variable named PHP_FCGI_MAX_REQUESTS, and match it to the value in Instance MaxRequests (recommendation for both is 10000).
• Click OK.

Cool! IIS now knows that your PHP folder is a CGI process, it now knows how to handle requests to PHP with this processor. Now let’s set up the individual website to use PHP CGI.

• Find your container in IIS (e.g. Default Web Site) and click it.
• Open Handler Mappings.
• On the right-hand side, choose ‘Add Module Mapping‘.
• Add the following entry:
  • *.php for Request Path.
  • FastCgiModule for Module.
  • Path to your PHP CGI for Executable.
  • Whatever you want for Name.
• Head back, and go into Default document.
• Add index.php to the list (your choice).
• Test in your browser if PHP loads up.
  • Try index.php file with <?php phpinfo();

If you do the above for the topmost entry (normally your machine name), it will copy to all new containers, so you don’t need to do this process for each site.

Recommended php.ini Configuration

The perfect php.ini configuration is very much a game of trial and error. Believe me, it’s difficult to find the best config balance when it comes to PHP, WordPress and Windows. Here are some essentials:

• cgi.force.redirect = 0 (essential!).
• fastcgi.impersonate = 1
• extension_dir = <Absolute path to install>/ext

These are set when using PHP Manager. This configures PHP to understand that it is operating via CGI mode. The second configuration also helps to link the PHP operations into how IIS works, enabling better interop between PHP and IIS.

The third is recommended especially if your PHP installation is not located on the C drive. Absolute stops PHP trying to interpret where the extension dir is, which is can get very wrong if not located on the C drive.

Setting up WordPress

Now for an easy part – the WordPress installation! Thankfully this is as easy to do, if not easier than the Linux server counterpart.

Create your desired site in IIS. If you’re binding this a domain or subdomain, create a new site. Otherwise, you can create a subfolder (or virtual subfolder) in IIS to setup a subfolder WordPress installation.

In the folder you bound to the container, extract the WordPress installation zip (or use WP-CLI if installed earlier). If done correctly when you visit the URL in the browser you will see the good ol’ 5 minute installation screen.

Run through the installation as per a normal site, and congratulations – you have a WordPress site running on IIS!

⭐ Special Thanks

In the hopes of keeping the information up to date and relevant, the following commenters below have helped keep me in check:

• Patrick Bates for pointing out Web Platform Installer.
• John Wilkin for pointing out I did not cover web.config.

ℹ️ FAQ

I recieved an error: 500.21 Handler “xyz” has a bad module “FastCGIModule” in its module list.

When installing Internet Information Services (IIS), PHP runs through CGI. This lets IIS pass the processing of non-Microsoft language code to it’s relevant processor. For us, it enables IIS to chuck .php code at PHP.

This error simply means that the CGI module it uses (FastCGI) was not installed. This is easily fixed!

Open up Server Manager. At the top right, open up Manage, then Add Roles and Features.

Next next next it through until you get to Roles. In Web Server (IIS) > Web Server > Application Development > Check CGI. Click Install (or next until you can), and your IIS server should now support CGI, including FastCGI

<security>
  <requestFiltering>
    <denyUrlSequences>
      <add sequence="xmlrpc.php" />
    </denyUrlSequences>
  </requestFiltering>
</security>

How do I set permissions?

The container will default to using the account IUSR, which won’t have access rights by default. For starting out, you could simply give IUSR full permissions to the folder, and your website will work. Updates will occur, cache will write, all gold.

This sometimes does not work, in which an alternative you can do is change Anonymous authentication in Authentication on the container to Application Pool identity, and give IUSRS group full access.

Both of these are not recommended for production use, as in the event of a compromise the hacker will have full write access. You can check out the guide on permissions from WordPress, as the permission fundamentals are similar.

Article was updated on the 21st June 2020 to elaborate on the web.config file, and cover WMI deployment.