Yes—you can run multiple websites on a single Windows server and public IP with IIS. The usual production design is one IIS site per domain, separate content folders and application pools, DNS records pointing to the same IP, and unique host-name bindings on ports 80 and 443. For multiple HTTPS sites sharing one IP and port 443, enable Server Name Indication (SNI) and bind each site to the certificate covering its domain.
The complete request path is:
Domain → DNS → public IP → router/cloud firewall → Windows Firewall → IIS binding → IIS site → application pool → files/applicationHow IIS decides which site should answer
An IIS binding identifies a site using a combination of:
As an Amazon Associate I earn from qualifying purchases.
- Protocol, normally
httporhttps - IP address
- TCP port
- Optional host name, also called a host header
For example, these bindings can coexist:
| Site | Protocol | IP | Port | Host name |
|---|---|---|---|---|
| Site 1 | HTTP | All Unassigned | 80 | site1.example.com |
| Site 2 | HTTP | All Unassigned | 80 | site2.example.com |
| Site 1 | HTTPS | All Unassigned | 443 | site1.example.com |
| Site 2 | HTTPS | All Unassigned | 443 | site2.example.com |
With HTTP, the browser sends the requested domain in the Host header. With HTTPS, the domain is normally supplied during the TLS handshake through SNI, allowing IIS to select the matching certificate and site. See Microsoft’s IIS binding reference for the binding format and SNI flags.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose a site-disambiguation method
Name-based bindings: the normal choice
Use the same public IP and standard ports, but give every site a unique host name:
#1 Best Overall
- Server-Class Home Server Built for 24/7 Workloads - Designed as a purpose-built home server rather than general-purpose SBCs, Mini PCs, entry NAS systems, or routing-only devices. As a compact, pocket-sized single board server platform, ZimaBoard 2 1664 combines x86 architecture, quad-core performance up to 3.6GHz, 16GB DDR5 memory, and 64GB eMMC storage for reliable always-on home servers, homelabs, and self-hosted workloads.
- PCIe 3.0 x4 Expansion for Real Server Builds - Built as a server-class platform with native PCIe expansion, ZimaBoard 2 features a full PCIe 3.0 x4 slot for high-speed, low-latency upgrades beyond USB-based limitations. Supports 10GbE NICs, NVMe adapters, GPUs, and AI accelerators to build scalable home servers, homelabs, and advanced self-hosted systems—offering greater expansion flexibility than typical SBCs, Mini PCs, and entry-level NAS devices.
- Native Dual SATA & Dual 2.5GbE Networking - Built with server-class storage and networking I/O, ZimaBoard 2 integrates dual SATA ports for direct HDD/SSD connectivity and dual 2.5GbE Ethernet for high-throughput, low-latency networking. This architecture enables reliable DIY NAS, fast storage, routing, and multi-service home server deployments—while avoiding USB-based performance constraints common in ARM SBCs, Raspberry Pi–based setups, Mini PCs, and entry-level NAS devices.
- ZimaOS Preinstalled + Wide OS Compatibility - Comes preinstalled with ZimaOS for a clean, ad-free private cloud experience—centralized file dashboard, automatic backups, P2P downloads, private photo/video sharing, 500+ plug-ins, and secure on-device AI that keeps your data at home. Also supports TrueNAS, Proxmox, Debian, Ubuntu Server, pfSense, OpenWrt, and Linux containers, making it perfect for Plex media servers, Pi-hole, firewalls, backups, Docker labs, home-cloud services, and multi-service deployments.
- All-in-One NAS, Router, Docker & Homelab Server - Replace multiple devices with one low-power. ZimaBoard 2 can serve as a NAS, router, Docker host, firewall, media server, or homelab node—delivering a flexible, open alternative to ARM SBCs, Mini PCs, and entry-level NAS systems.
http/*:80:site1.example.com
http/*:80:site2.example.com
https/*:443:site1.example.com
https/*:443:site2.example.comThis avoids requiring visitors to type unusual ports and makes adding domains straightforward. It does require accurate DNS, certificates, and SNI configuration for shared HTTPS.
Separate IP addresses
Assign each site a different IP and bind it to that address:
http/192.0.2.10:80:site1.example.com
http/192.0.2.11:80:site2.example.comThis can help with legacy TLS clients or unusual certificate requirements, but additional IP addresses may be difficult or costly to obtain. DNS and certificates are still required.
Separate ports
You can use bindings such as http/*:8080:site1.example.com and http/*:8081:site2.example.com. This is useful for development or internal services, but public users must include the port and firewalls may block it. For public websites, ports 80 and 443 are usually preferable. IIS supports all three approaches; Microsoft describes them in its IP, port and host-header guidance.
Prerequisites
- Windows Server with IIS installed and administrative access
- A separate physical directory for each site
- DNS control for every domain
- TCP 80 and 443 permitted by any cloud security group, router and Windows Firewall rule
- The application runtime required by each website
- Certificates covering every HTTPS name
- NTFS permissions for each application-pool identity
Point the domains to the server
Each public domain must resolve to the server’s reachable public IP. A typical DNS setup is:
example.com A 203.0.113.10
www.example.com CNAME example.com
example.net A 203.0.113.10If the server is behind a router, forward TCP 80 and TCP 443 to its private IP. In a cloud environment, allow those ports in the provider’s network firewall or security group as well as Windows Firewall.
For local testing, use internal DNS or add temporary entries to C:WindowsSystem32driversetchosts. DNS is controlled by your DNS provider; IIS cannot fix a record pointing to the wrong address. If you publish both example.com and www.example.com, treat them as separate host names: add both bindings, ensure the certificate covers both, and redirect one to your preferred canonical name.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Create the sites in IIS Manager
1. Create separate content directories
C:Sitessite1
C:Sitessite2Deploy each website into its own directory. Do not share a writable web root between unrelated sites unless shared content is deliberate.
2. Create application pools
- Open IIS Manager.
- Select the server in the Connections pane.
- Open Application Pools.
- Select Add Application Pool….
- Create pools such as
Site1PoolandSite2Pool. - Choose the runtime and pipeline settings required by each application.
Assigning unrelated websites to separate pools limits the impact of process crashes, recycling, incompatible runtime settings and some configuration conflicts. It is not complete security isolation: applications still share the Windows host and its resources. Each additional pool also consumes memory and adds administration.
For ASP.NET Core, No Managed Code is commonly selected because the ASP.NET Core Module handles forwarding to the application. Match the hosting model and prerequisites to the application’s deployment requirements; see Microsoft’s ASP.NET Core IIS hosting guidance.
3. Add the first HTTP site
- Right-click Sites and select Add Website….
- Enter a site name such as
Site1. - Select its application pool.
- Set the physical path to
C:Sitessite1. - Set Type to
http. - Choose All Unassigned or a specific IP.
- Set Port to
80. - Enter
site1.example.comin Host name. - Leave Start Website Immediately selected when appropriate, then click OK.
4. Add the second site
Repeat the process with:
Site name: Site2
Physical path: C:Sitessite2
Protocol: http
IP address: All Unassigned
Port: 80
Host name: site2.example.comBoth sites use port 80 because their host names are different.
Recommended Free Tools
Configure HTTPS with SNI
For each HTTPS name, obtain a certificate whose subject alternative names include the exact host name. A single-domain certificate covers one name. A wildcard such as *.example.com generally covers first-level subdomains but not the bare example.com unless that name is also included. A SAN certificate can cover several explicitly listed names.
Rank #3
- TRUE PLUG-AND-PLAY HOME SERVER: Forget complex VPS setups or command lines. Simply connect power and Ethernet to start hosting immediately with zero technical skills required. This managed, all-in-one appliance is the easiest way to run blogs (compatible with WordPress), private applications, and bots directly from home using your own domain.
- NO MONTHLY SUBSCRIPTION FEES: Stop renting server space. Enjoy a one-time hardware purchase model with absolutely no recurring hosting fees for typical usage. The system includes a generous monthly traffic allowance that covers the needs of almost all personal and small business websites, allowing the device to pay for itself quickly.
- INSTANT ONE-CLICK APP LIBRARY: Instantly deploy over 50 curated open-source applications without hassle. The diverse ecosystem includes essential tools, compatible with WordPress, Ghost, Nextcloud (for private cloud storage), Joomla, and OpenClaw. Perfect for content management, e-commerce, private email, and business tools.
- INCLUDES FREE SSL & ENTERPRISE SECURITY: Get professional performance and safety without the extra costs. Seamlessly integrate your existing custom domain or utilize the included free subdomain. Your sites are automatically secured with free SSL certificates, built-in DDoS protection, and global CDN acceleration.
- TOTAL DATA PRIVACY & OWNERSHIP: Keep your digital assets secure on your own local hardware, not on third-party "big tech" servers. Designed for privacy-conscious individuals, creators, and small businesses seeking platform independence. Includes an intuitive web management portal for complete peace of mind.
- Import the certificate into the server’s certificate store. Confirm that it includes an accessible private key.
- In IIS Manager, expand Sites and select the site.
- Choose Bindings…, then Add.
- Set Type to
https. - Choose All Unassigned or the site’s specific IP.
- Set Port to
443. - Enter the exact host name, such as
site1.example.com. - Select the matching certificate.
- Enable Require Server Name Indication when multiple HTTPS sites share the same IP and port.
- Click OK and repeat for every HTTPS site.
SNI is supported by modern browsers and operating systems, but legacy clients may not support it. If compatibility with such clients is mandatory, separate IP addresses may be more appropriate. Without SNI, IIS cannot reliably associate multiple certificates with one IP-and-port combination. The binding’s sslFlags value of 1 represents SNI in IIS configuration.
Automate the configuration
Run these AppCmd commands from an elevated Command Prompt. AppCmd is IIS’s command-line administration tool; Microsoft documents it in the AppCmd reference.
mkdir C:Sitessite1
mkdir C:Sitessite2
%windir%system32inetsrvappcmd add apppool /name:Site1Pool
%windir%system32inetsrvappcmd add apppool /name:Site2Pool
%windir%system32inetsrvappcmd add site ^
/name:Site1 ^
/physicalPath:C:Sitessite1 ^
/bindings:http/*:80:site1.example.com
%windir%system32inetsrvappcmd add site ^
/name:Site2 ^
/physicalPath:C:Sitessite2 ^
/bindings:http/*:80:site2.example.com
%windir%system32inetsrvappcmd set app "Site1/" /applicationPool:Site1Pool
%windir%system32inetsrvappcmd set app "Site2/" /applicationPool:Site2PoolThe trailing slash identifies each site’s root application. The binding format is protocol/IP_Address:port:host_header.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe WebAdministration PowerShell module provides an equivalent approach:
Import-Module WebAdministration
New-Item -ItemType Directory -Path 'C:Sitessite1' -Force
New-Item -ItemType Directory -Path 'C:Sitessite2' -Force
New-WebAppPool -Name 'Site1Pool'
New-WebAppPool -Name 'Site2Pool'
New-Website -Name 'Site1' -Port 80 `
-HostHeader 'site1.example.com' `
-PhysicalPath 'C:Sitessite1' `
-ApplicationPool 'Site1Pool'
New-Website -Name 'Site2' -Port 80 `
-HostHeader 'site2.example.com' `
-PhysicalPath 'C:Sitessite2' `
-ApplicationPool 'Site2Pool'Microsoft’s New-Website reference also documents SSL-related parameters for Windows Server 2025.
Set NTFS permissions correctly
For a standard application-pool identity, the account commonly used by Site 1 is:
Rank #4
IIS AppPoolSite1PoolGrant read and execute permission to ordinary site content. Grant Modify only to specific upload, cache or generated-content directories that must be writable. Avoid granting broad write access to the entire web root.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review application secrets in web.config, deployment accounts, scheduled tasks, database credentials, backups and management-plane access. Separate sites and pools improve administration and reduce accidental interference, but they are not a substitute for tenant-level security or separate virtual machines.
Test the entire request path
Test with the real host names, not only the server IP. An IP-only request does not exercise a name-based binding and may be served by the default site or another fallback binding.
Resolve-DnsName site1.example.com
Test-NetConnection site1.example.com -Port 443Then test:
http://site1.example.com
https://site1.example.com
http://site2.example.com
https://site2.example.comTo test an HTTP binding against a known IP while supplying the required host name:
Invoke-WebRequest `
-Uri 'http://203.0.113.10/' `
-Headers @{ Host = 'site1.example.com' }For HTTPS, use the actual domain, a temporary hosts-file override, or a TLS testing method that preserves the intended SNI name. Inspect IIS logs, Windows Event Viewer, Failed Request Tracing and the application’s own logs when the basic request succeeds at IIS but fails inside the application.
Troubleshooting matrix
| Symptom | Likely causes and checks |
|---|---|
| Wrong site appears | IP-only request, incorrect DNS, misspelled host binding, wildcard binding, default site, or a proxy rewriting the Host header. |
| Binding conflict | Another site already owns the same IP, port and host-name tuple. For HTTPS also check SNI and certificate bindings. |
| Wrong HTTPS certificate | Certificate name mismatch, missing SNI, wrong certificate store, missing private key, wrong public IP, or TLS terminating at a proxy. |
| Works locally but not online | Public DNS, NAT, Windows Firewall, cloud security groups, ISP port blocking, dynamic public IP or an upstream proxy. |
| HTTP works but HTTPS fails | No port-443 binding, blocked 443, expired or mismatched certificate, missing private key, incorrect SNI or an application redirect problem. |
| 403 Forbidden | NTFS permissions, authentication settings, directory browsing or application authorization. |
| 404 Not Found | Incorrect physical path, missing default document, routing, URL Rewrite, nested application or undeployed files. |
| 500 Internal Server Error | Invalid web.config, missing runtime or module, failed database connection, missing environment variable or application crash. |
| Application pool stops | Startup exception, crash, memory pressure, architecture mismatch, permission failure, Rapid-Fail Protection or endpoint-security interference. |
List the configured sites and bindings with:
%windir%system32inetsrvappcmd list site
%windir%system32inetsrvappcmd list site /text:name,bindingsIf an unintended site catches requests, look for a binding such as http/*:80:. A top-level wildcard can become a fallback for unmatched host names and, in some ASP.NET Core configurations, can create security risks. Do not automatically delete the Default Web Site; inspect its bindings and change or remove only what conflicts with your design.
Best Value
- Server-Class Home Server Built for 24/7 Workloads - Designed as a purpose-built home server rather than general-purpose SBCs, Mini PCs, entry NAS systems, or routing-only devices. As a compact, pocket-sized single board server platform, ZimaBoard 2 832 combines x86 architecture, quad-core performance up to 3.6GHz, 8GB DDR5 memory, and 32GB eMMC storage for reliable always-on home servers, homelabs, and self-hosted workloads.
- PCIe 3.0 x4 Expansion for Real Server Builds - Built as a server-class platform with native PCIe expansion, ZimaBoard 2 features a full PCIe 3.0 x4 slot for high-speed, low-latency upgrades beyond USB-based limitations. Supports 10GbE NICs, NVMe adapters, GPUs, and AI accelerators to build scalable home servers, homelabs, and advanced self-hosted systems—offering greater expansion flexibility than typical SBCs, Mini PCs, and entry-level NAS devices.
- Native Dual SATA & Dual 2.5GbE Networking - Built with server-class storage and networking I/O, ZimaBoard 2 integrates dual SATA ports for direct HDD/SSD connectivity and dual 2.5GbE Ethernet for high-throughput, low-latency networking. This architecture enables reliable DIY NAS, fast storage, routing, and multi-service home server deployments—while avoiding USB-based performance constraints common in ARM SBCs, Raspberry Pi–based setups, Mini PCs, and entry-level NAS devices.
- ZimaOS Preinstalled + Wide OS Compatibility - Comes preinstalled with ZimaOS for a clean, ad-free private cloud experience—centralized file dashboard, automatic backups, P2P downloads, private photo/video sharing, 500+ plug-ins, and secure on-device AI that keeps your data at home. Also supports TrueNAS, Proxmox, Debian, Ubuntu Server, pfSense, OpenWrt, and Linux containers, making it perfect for Plex media servers, Pi-hole, firewalls, backups, Docker labs, home-cloud services, and multi-service deployments.
- All-in-One NAS, Router, Docker & Homelab Server - Replace multiple devices with one low-power, fanless system. ZimaBoard 2 can serve as a NAS, router, Docker host, firewall, media server, or homelab node—delivering a flexible, open alternative to ARM SBCs, Mini PCs, and entry-level NAS systems.
Sites, applications and virtual directories are not the same
Create a new site when the content has its own domain, bindings, deployment boundary or lifecycle. Create an application when a path such as example.com/admin needs its own application boundary or pool. Use a virtual directory when a URL path should map to another physical directory without necessarily becoming a separate application.
For example, example.com/blog and example.com/shop may belong under one site. Separate domains such as example.com and example.net are usually clearer as separate sites.
Reverse proxies and IPv6
If IIS sits behind Azure Application Gateway, an AWS load balancer, Cloudflare, ARR, Nginx or another reverse proxy, the public routing and TLS termination may happen before IIS. The proxy must route by host name and preserve or correctly rewrite the Host header. The public certificate may belong on the proxy rather than IIS, and forwarded-header configuration may be needed for accurate client IPs and HTTPS detection.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11For dual-stack hosting, check both A and AAAA records, firewall rules and IIS address bindings. A working IPv4 path does not prove that the IPv6 path reaches the same server or site.
FTP is separate: IIS website bindings for HTTP and HTTPS do not configure FTP sites.
When one IIS server is the wrong boundary
One server is practical for related sites, small deployments and applications that can share host resources. Consider separate virtual machines, containers where the application stack supports them, separate managed services or a reverse-proxy architecture when sites are unrelated, untrusted, resource-intensive or subject to different maintenance and security requirements.
If you need full Windows and IIS control without owning hardware, compare a Windows VM such as Azure Virtual Machines or Amazon EC2 Windows. If you want less server administration, evaluate Azure App Service on Windows or a managed Windows host. Check administrator access, backups, certificate automation, framework support, app-pool controls, deployment options, resource limits and renewal pricing before choosing a provider. IIS itself is a Windows feature, not a separately purchased generic hosting product.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
