Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. inetpub
  3. wwwroot
FolderRisk: Caution

wwwroot C:\inetpub\wwwroot

wwwroot: the IIS Default Web Site folder (iisstart.htm welcome page); it exists when IIS is installed, on client or server.

Updated on By AltF4 Formation

What it’s for

wwwroot is the physical folder of the “Default Web Site” created when IIS is installed, bound to port 80 by default (id 1 in applicationHost.config). An HTTP request that names no specific site ends up here, and IIS serves the welcome page. It exists only if IIS is installed: the IIS feature on Windows 10 and 11, the Web Server role on Windows Server.

What it contains

After an installation, iisstart.htm (the welcome page) and iisstart.png. The DefaultAppPool application pool, running as IIS AppPool\DefaultAppPool, reads this folder; the IIS_IUSRS and IUSR groups have read permissions on it.

Risks and best practices

  • Do not deploy your applications here. Create a dedicated folder and site, then grant read access to IIS_IUSRS or the pool identity, and write access only where the application must write.
  • Remove iisstart.htm or the default site on an exposed server: the welcome page reveals that IIS is running.
  • The parent C:\inetpub folder has been protected by Microsoft since April 2025; do not delete inetpub as a whole.

Useful commands

Fenêtre de terminal
# Default site: folder and bindings
Import-Module WebAdministration
Get-Website -Name 'Default Web Site' | Select-Object Name, PhysicalPath, Bindings


# Permissions on the folder
icacls C:\inetpub\wwwroot

Report a mistake