1.2 Ensure 'host headers' are on all sites

Information

Host headers provide the ability to host multiple websites on the same IP address and port. It is recommended that host headers be configured for all sites.

Requiring a Host header for all sites may reduce the probability of:
- DNS rebinding attacks successfully compromising or abusing site data or functionality [2]
- IP-based scans successfully identifying or interacting with a target application hosted on IIS

Solution

Obtain a listing of all sites by using the following appcmd.exe command:
%systemroot%\system32\inetsrv\appcmd list sites

Perform the following in IIS Manager to configure host headers for the Default Web Site:
1. Open IIS Manager
2. In the Connections pane expand the Sites node and select Default Web Site
3. In the Actions pane click Bindings
4. In the Site Bindings dialog box, select the binding for which host headers are going to be configured, Port 80 in this example
5. Click Edit
6. Under host name, enter the sites FQDN, such as <www.examplesite.com>
7. Click OK, then Close
Note: Requiring a host header may impair site functionality for HTTP/1.0 clients.

See Also

https://workbench.cisecurity.org/files/166

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CSCv6|3.1

Plugin: Windows

Control ID: e0c648e775441ae7d3381182d8908050cd993800ec97fd37320ced5741455d68