Ensure 'Host headers' are on all sites

MediumLevel 1Automatediis

Description

Host headers provide the ability to host multiple websites on the same IP address and port. It is recommended that host headers be configured for all sites. Note: Wildcard host headers are now supported. Every http binding must include a host name (IP:port:host); bindings such as *:80: fail. PowerShell 5.1 with the WebAdministration module; run elevated.

How it is checked

Audit method: Shell command

shell

Import-Module WebAdministration -ErrorAction Stop; $bad = @(Get-WebBinding | Where-Object { $_.protocol -eq 'http' -and ($_.bindingInformation -split ':')[2] -eq '' }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set-WebBinding -Name '<site>' -BindingInformation '*:80:' -PropertyName HostHeader -Value '<fqdn>'

Properties

Operating systems: Any
Tags: iisnetwork
Reference: CIS Microsoft IIS 10 Benchmark v1.2.1 - 1.2 Ensure 'Host headers' are on all sites

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target iis