How to Secure Your ASP.NET Applications on Plesk and Windows Server 2019

On shared Windows hosting, security is split between two parties. Domain India looks after the server: Windows updates, IIS, the firewall and the Plesk installation. You look after everything your application does and every password that opens your account. Most ASP.NET sites that get compromised are broken through the second half, so this guide focuses on the steps in your hands.

1. Who secures what

Because the server side is managed, steps such as "configure the Windows firewall" or "install a web application firewall" are not something you do on shared hosting. If you think something at server level is wrong, open a ticket.

2. Lock down your logins

• Client area: turn on two-factor authentication. Anyone who gets into the client area can open Plesk with one click. See Enable two-factor authentication.
• Plesk: use a long, unique password. Reset it from Manage › Access › Reset password in the client area if you think it has leaked; see Reset your Plesk password.
• FTP: give each developer their own FTP account where Plesk allows it, and remove accounts that are no longer needed.
• Database users: one user per application, with a random password. Never reuse your Plesk password for a database.
• Never share passwords by email or chat. Domain India support will never ask for a password.

3. Keep secrets where the web can't read them

IIS refuses to serve web.config, and an ASP.NET Core app serves static files only from wwwroot. Risk comes from copies and wrong placement:

• never leave web.config.bak, appsettings.json.old or a .zip of your site in httpdocs;
• never put API keys or connection strings in JavaScript or anything under wwwroot;
• keep the production connection string in configuration on the server, not in your Git repository.

4. Switch off detailed errors

Detailed error pages show file paths, code and settings. In production:

• ASP.NET Core: run as Production (the default when nothing is set), and use app.UseExceptionHandler("/Error"), not the developer exception page.
• .NET Framework: set customErrors to RemoteOnly or On, and debug to false on the compilation element in web.config.
• Logs: if you turned on the ASP.NET Core stdout log to debug, turn it off again.

5. Write code that resists common attacks

For a structured checklist, see How to use OWASP security guidelines.

6. Keep dependencies up to date

Outdated packages are a common way in. From your project folder:

dotnet list package --vulnerable --include-transitive

Update anything it reports, rebuild and redeploy. Keep your app on a .NET version that Microsoft still supports, and check in Plesk which versions the server offers.

7. Send security headers

Headers tell browsers to block common tricks. In web.config, inside system.webServer:

<httpProtocol>
  <customHeaders>
    <add name="X-Content-Type-Options" value="nosniff" />
    <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
    <add name="Content-Security-Policy" value="frame-ancestors 'self'" />
  </customHeaders>
</httpProtocol>

Add HTTPS with HSTS as described in Configuring SSL for ASP.NET sites. Test after each change: a strict Content-Security-Policy can block your own scripts. If web.config then gives a 500.19 error, remove the last section you added.

8. Watch logs and keep backups

• Logs: look at your Plesk access logs from time to time for bursts of failed logins or requests to paths you don't have, such as /wp-login.php. See How to check Plesk logs.
• Backups: backups included with Domain India shared hosting, Windows included, are weekly. Keep your own copy of files and databases before every deployment; Creating backups in Plesk shows how.
• If you are hacked: follow the security checklist for a hacked website, change every password, and open a ticket.

9. Where Domain India Windows hosting fits

Every Windows plan is managed in Plesk, with free SSL and the server side maintained by Domain India. The cards show live prices, excluding 18% GST.

ASP Enterprise lists a dedicated application pool, which keeps your app in its own worker process, separate from other customers' sites.

Ready to run your ASP.NET app on managed Windows hosting? Compare the Windows hosting plans, or open a ticket if you suspect a security problem. Support is on 24/7 live chat, and tickets get a first response within 15 minutes.