Windows Server web hosting setup
Set up a Windows Server for web hosting in one click
A fresh Windows Server 2019, 2022 or 2025 becomes a hardened, production-grade IIS, PHP and MySQL web host in minutes. No PowerShell, no forum threads, no specialist's day rate. ServerMaid runs the checklist a specialist would follow, explains every step in plain English, and proves the result with a validation suite and a health score.
From £99 £49.50 per server for twelve months. Your account is ready within minutes, with the ServerMaid installer and your licence ready to download. 30-day money-back promise.
What a proper Windows web server setup actually involves
Installing IIS is the easy part. A server that is safe to put on the internet also needs the right IIS role services, an official PHP build wired into FastCGI with a production php.ini, a database engine that only listens locally with a real root password, folder permissions that give each website exactly what it needs and nothing more, a firewall that lets the web in and keeps everything else out, a security baseline for Windows itself, HTTPS with certificates that renew, backups that have been proven to restore, and a way to check all of it is still true next month.
Done by hand that is a weekend of half-right blog posts. Done by a contractor it is a day rate, and another one for every change. ServerMaid does it as one deployment with live progress, a snapshot taken first so anything can be rolled back, and a commissioning report at the end.
The websites that go on it get the same care. Each one is added from one form with its own folders, application pool, database user and free certificate*, and a checkbox (the WordPress module, included in every Agency licence) installs the latest WordPress from wordpress.org into the site, already hardened: file editor off, PHP refused in the uploads folder, xmlrpc.php refused, security releases installing themselves. The one-click WordPress install.
The build, step by step
Everything BUILD MY SERVER does for you
Pre-flight and snapshot
Checks the operating system, memory, disk and network, detects anything already installed, and takes a configuration snapshot before touching the machine. Existing IIS, PHP or MySQL is reported and left alone, never silently replaced.
IIS with the right role services
Installs the web server role with static content, default documents, logging, request filtering, CGI for PHP and URL Rewrite. Nothing you do not need, nothing missing that a PHP site depends on.
Official PHP, verified
Advanced Setup asks which PHP line should be the server default, PHP 8.4 (recommended), 8.5 (latest) or 8.3 (security fixes only), each explained; Quick Setup keeps 8.4. ServerMaid downloads the newest build of that line from windows.php.net, checks its published SHA-256 fingerprint, installs the Visual C++ runtime it needs and registers FastCGI with recycling and timeouts a production server wants. More on PHP and MySQL.
MySQL or MariaDB, local only
Installs a signed package, binds the server to localhost, generates a 32-character root password kept in an encrypted vault, removes anonymous accounts and the sample database. Each website later gets its own database and account with rights on that database only.
Folders, permissions and firewall
Creates a clean websites root with wwwroot, logs, private, temp and backups per site, computes the exact NTFS permissions each folder needs, and applies firewall rules named so you can see which are ServerMaid's. More on hardening.
Security baseline
Remote Desktop requires Network Level Authentication and is limited to the addresses you connect from, SMBv1 is off, the Guest account is disabled, Defender real-time protection is on, account lockout, password and audit policies are set. Every control is explained before it is applied.
Free SSL* that renews itself
Every website gets a certificate from Let's Encrypt, installed into IIS with an HTTPS redirect and renewed by a scheduled task before it expires. More on free SSL.
Backups proven by restore
Websites, databases and configuration on a schedule, verified by fingerprint and by replaying each database dump into a scratch schema. More on backups.
Validation and report
A validation suite probes services, ports, DNS, outbound HTTPS and the database, and tests PHP through a temporary diagnostic website that is removed afterwards. The deployment fails if anything real is wrong. You get a health score with reasons and a commissioning report.
* Free SSL certificates need the Websites and SSL module (included in Agency and Enterprise licences) on a licence within its twelve-month period. Certificates come from Let's Encrypt; new websites get one while the licence is in date, and certificates already issued keep renewing.
Why it is safe to click
Preview first, roll back any step, never locked out
Preview changes
PREVIEW CHANGES lists every step with its risk label before anything runs. Quick Setup asks two questions; Advanced Setup exposes every choice with a recommended default.
Journaled, reversible
Every change is checked first, applied only when needed, verified afterwards and recorded, so any deployment can be rolled back step by step.
Remote Desktop protected
Changes that could affect your remote access run with an auto-revert timer. If you cannot confirm you are still connected, ServerMaid undoes them by itself.
Questions about setting up a Windows web server
Which versions of Windows Server does it support?
Windows Server 2019, 2022 and 2025, 64-bit, with an internet connection, run as an administrator. Windows 10 and 11 work for evaluation only.
Do I need to install anything first?
No. ServerMaid downloads and verifies the IIS features, PHP and the database engine itself. The only things you copy to the server are the installer and your licence file.
How long does the build take?
Usually minutes, most of it downloading PHP and the database package. Every step shows live progress, and the validation suite runs at the end.
Can I use it on a server that already hosts something?
Yes. Pre-flight detects what is there. Anything ServerMaid did not install is reported and left alone, and if it cannot proceed safely it says so before changing anything.
What if something goes wrong later?
Repair scans the server against what it should look like, fixes safe issues in one click and rolls back any deployment step by step. The health score tells you what is wrong and why, with the fix previewed before it runs.
Ready to turn that fresh server into a web host?
Pick the modules you need, pay for twelve months, copy the installer and licence to the desktop and click once. The whole plan is shown before anything changes, and every step can be rolled back.