securing Windows 2003 web server

Posted on 2006-03-23
Last Modified: 2013-12-04
I have a windows 2003 server and i am about to host a website on that server. this is a dedicated server and i would like to make sure i am safe and secured. What are the main things i should concentrate on...?
1) Firewall
3)web application security tester etc. (like to know how this works)

Please provide me with the links of the good products FREE/paid,

I really welcome any expert advice on this.
Question by:str_kani
    LVL 23

    Assisted Solution

    With Windows 2003, I would load SP1, get the server where you want it (IIS installed, website installed, etc.) then run the SCW (security configuration wizard) which you'll have to install from add/remove programs, Windows components.

    This will "lock down" the server to only the essentials that you specify during the wizard (be careful and know what you are picking).  This greatly minimizes the "footprint" of the server and any exploits that could happen.

    Firewall - only publish the ports necessary for your website to function

    Antivirus - a simple on-access scanner should be sufficient

    Web Application tester - Imperva is the leader in this one

    My advice is to also post here the "technologies" your website will use, like ASP, java, flash, SQL database backend, PHP, etc. and then experts can tell you other things to look for on those technologies.
    LVL 12

    Author Comment

    thanks cleaner! :) can you please direct me to a on access scanner page? (a URL)

    My site user PHP, MySQL and Flash.
    LVL 23

    Assisted Solution

    by:TheCleaner - that will validate your code to standards - web app vulnerability tester  (most of these aren't free anymore anywhere)

    PHP -

    MySQL -  (also the Acunetix one above will scan for SQL injection vulnerabilities etc)
    LVL 12

    Author Comment

    Is there any simple and still free security scanners?
    LVL 23

    Accepted Solution


    You can use Nmap found here:

    I also recommend Qualys' site:

    click on Free Tools on the right and you'll get to scan for the Top 20 SANS, etc.  You'll need to use a legitimate email address though, since the SCAN url is sent to you.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive Gives IT Their Time Back

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
    Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now