Are there any specific setting changes for IIS specific to Sitecore? Or are general ASP.NET IIS best practices fully applicable to Sitecore?
I will recommend these specific settings for Sitecore in IIS:
- Ensure that Maximum Worker Processes for the Application Pool is set to 1 (under advanced settings)
- Ensure that Load User Profile settings of the Application Pool is set to "true" (under advanced settings)
- Ensure anonymous access is denied for:
- Enable HTTP keep alive
- Enable static content compression
- On the CMS server, enable dynamic content compression
- Disable execute permissions on the upload folder
- Enable content expiration using HTTP response headers, especially for the /sitecore folder (optional)
For a multisite solution it is recommended to have just one application pool for all websites.
In addition to the answer from @Sitecore Climber, there's another thing you should be aware of:
- IIS and .NET requirements are different based on Sitecore version, and available depending on the Operational System you want to run.
On Sitecore 6.5, the IIS version should be at least 5.1 with a .NET 3.5 SP1 in place.
On Sitecore 7.5, the IIS version should be at least 7.0 with .NET 4.5 in place