Set Up WP Ghost on Windows IIS Server – web.config Rewrite Rules
June 6, 2020
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
WP Ghost (formerly Hide My WP Ghost) works on Windows IIS servers. After saving your security level, add the rewrite rules WP Ghost generates to your web.config file and restart IIS. WP Ghost uses IIS URL Rewrite module rules instead of Apache .htaccess rules.
How to Set Up WP Ghost on IIS
Step 1: Select Safe Mode or Ghost Mode
Go to WP Ghost > Change Paths > Level of Security. Select Safe Mode or Ghost Mode. Customize paths or keep the defaults. Click Save.

Step 2: Add Rewrite Rules to web.config
After saving, WP Ghost displays the rewrite rules you need to add to your web.config file. Open the web.config file in the root directory of your website. Add the WP Ghost rewrite rules inside the <system.webServer> section.


Save the web.config file and click “Okay, I set it up” in WP Ghost.
Step 3: Restart IIS
Open IIS Manager. Select your server in the left Connections pane. In the right Actions pane, click Restart. This reloads the web.config with the new rewrite rules.

Step 4: Run the Frontend Test
Click the Frontend Test button in WP Ghost. Verify the site loads correctly with new paths. If everything works, click “Yes, it’s working”. If there are issues, click “No, abort” to roll back.

Prerequisites
The IIS URL Rewrite module must be installed on your server. WP Ghost’s rewrite rules require this module. If it is not installed, download it from Microsoft’s IIS URL Rewrite page. Without this module, rewrite rules in web.config will not work.
Troubleshooting
Custom paths return 404 after restart. Verify the URL Rewrite module is installed. Check that the rewrite rules are inside the <system.webServer> section of web.config. Confirm IIS was restarted after adding the rules.
web.config syntax error prevents site from loading. IIS shows a detailed error page with the line number. Fix the syntax error in web.config. If you cannot identify the issue, restore the backup web.config and re-copy the rules from WP Ghost.
Locked out after configuration. Use the Safe URL parameter or rename the plugin folder via FTP/File Manager. See the Emergency Disable guide.
Frequently Asked Questions
Do I need to update web.config every time I change paths?
Yes. Unlike Apache (.htaccess is updated automatically), IIS requires you to manually update web.config with the new rules WP Ghost generates after each path change. Restart IIS after updating.
Does WP Ghost auto-detect IIS?
Yes. WP Ghost detects the server type and generates IIS-compatible rewrite rules (XML format for web.config) instead of Apache .htaccess rules.
Is this a common WordPress hosting setup?
IIS is less common for WordPress than Apache or Nginx. It is used in Windows-based hosting environments and Azure App Service. Most IIS WordPress setups require the URL Rewrite module for permalink support.
Does WP Ghost modify WordPress core files?
No. WP Ghost generates rewrite rules for web.config and uses WordPress hooks. No core files modified. Removing the rules from web.config restores all defaults.
Related Tutorials
Nginx Server Setup – for Nginx-based servers.
AllowOverride All on Apache – for Apache-based servers.
Customize All WordPress Paths – configure paths after server setup.
Emergency Disable Guide – recovery if configuration causes issues.
Compatibility Plugins List – server compatibility notes.