IIS服务器如何禁止通过IP访问网站，仅允许域名访问？

Hey there! Blocking access via server IP and restricting traffic to only your domain is a common security requirement, and IIS gives you a couple of solid ways to do this. Let's walk through the most reliable methods:

This method is flexible and works even if you have multiple domains or need custom error responses. Here's how to set it up:

• First, make sure the URL Rewrite module is installed on your IIS server. If it's not, open IIS Manager, go to the "Management" section, click "Web Platform Installer", search for "URL Rewrite", and install it.
• Navigate to your target website in IIS Manager, then double-click the "URL Rewrite" icon in the middle pane.
• On the right-hand side, click "Add Rule(s)" and select "Blank Rule" from the list.
• Configure the rule with these settings:
  • Name: Give it a clear name like "Block IP Access"
  • Match URL:
    • Request path: Matches the Pattern
    • Using: Regular Expressions
    • Pattern: .* (this matches any request path)
    • Check the "Ignore case" box
  • Conditions: Click "Add" to create a new condition:
    • Input: {HTTP_HOST}
    • Match type: Does Not Match the Pattern
    • Pattern: ^yourdomain\.com$ (replace yourdomain.com with your actual domain. For multiple domains, use ^(yourdomain\.com|anotherdomain\.com)$)
    • Check the "Ignore case" box
  • Action:
    • Action type: Custom Response
    • Status code: 403 (Forbidden)
    • Reason phrase: Access Denied - Please use the authorized domain
    • Response body: You can add a simple HTML message like <h1>Access Denied</h1><p>Please access this application via our official domain: yourdomain.com</p>
• Click "Apply" to save the rule. Now any request coming through the server IP (or any non-authorized domain) will get a 403 error.

If you don't need custom error responses and just want to restrict bindings to your domain, this is a simpler option:

• Open IIS Manager, find your website, right-click it and select "Edit Bindings...".
• In the Site Bindings window, review all existing bindings:
  • Remove any bindings that use the server's IP address (either a specific IP or * for all IPs) for HTTP/HTTPS.
  • Only keep bindings that explicitly use your domain name (e.g., Type: HTTP, IP address: *, Host name: yourdomain.com; or the same for HTTPS with your domain's SSL certificate).
• Click "OK" to save the changes. Now IIS will only serve requests that match your domain's host header.

• Testing: After setting up either method, test by accessing your app via the server IP – you should get a 403 (or the custom error) response. Accessing via your domain should work normally.
• SSL Certificates: If you're using HTTPS, make sure your SSL certificate is issued for your domain (not the server IP) and is properly bound to the domain in IIS.
• Multiple Websites: If your server hosts multiple sites, ensure that no other site is bound to the server IP (unless intended) to avoid conflicts.

内容的提问来源于stack exchange，提问作者Nik Varma