A Windows hosting control panel built on IIS

Why a Windows hosting control panel should start from IIS#

Most hosting panels were designed around Apache or Nginx on Linux, and their Windows side came later. Windows hosting customers come for different things: ASP.NET applications that depend on web.config, ASP.NET Core apps behind the IIS ASP.NET Core Module, SQL Server databases, and sometimes classic sites that still need ODBC data sources. A panel that treats IIS as just another web server leaves those customers asking support to change settings over Remote Desktop.

StackRegent is a Windows hosting control panel that starts from the Microsoft stack. Every site is an IIS 10 site, every account runs as a Windows user, DNS runs on Microsoft DNS Server, FTP on the Microsoft FTP Service, mail on MailEnable, and the panel's secrets are encrypted with Windows DPAPI. Every object the panel creates is an ordinary Windows or IIS object, so your team's usual tools still work when you need to look underneath.

Windows Server versions and what each one adds#

StackRegent runs on Windows Server 2016, 2019, 2022 and 2025, including Server Core, where the IIS Manager and the Service Monitor tray app are skipped. Some features depend on the release:

The panel shows the same table under Tools & Settings › About StackRegent, with your server's release marked. Step-by-step guides for each version are in the install documentation.

One Windows user and one application pool per account#

Isolation starts with identity. Each subscription gets a Windows user with no administrative group memberships and a webspace that only that user, SYSTEM and Administrators can open. Each of its sites runs in an IIS application pool under that user, and anonymous requests run as the pool user rather than a shared account. A crash or memory leak in one customer's pool stays there.

PHP follows the same rule: FastCGI processes run as the subscription's user, with a php.ini built from the server file and the site's own settings, so customers cannot quietly change what their plan forbids. PHP uploads, temporary files and sessions stay in the webspace's own tmp folder. The Account Isolation page runs these tests per subscription, including one that tries to open another account's files as the subscription user, and repairs failures in one click. Resource limits and isolation has the details.

Resource caps through Windows job objects#

All processes of a subscription, its websites, PHP and scheduled tasks, run in one Windows job object. The service plan's Performance tab sets caps for CPU as a percentage of one core, memory, disk read and write speed, disk operations per second and the number of processes. A subscription can have its own limits, and server-wide defaults fill any resource a plan leaves unlimited. This is the Windows counterpart of CloudLinux LVE, and NTFS quotas cap disk space alongside it.

ASP.NET, ASP.NET Core and Node.js#

.NET Framework 4.x and ASP.NET 4.8 are part of Windows Server, and the installer enables them. The ASP.NET Core Hosting Bundle installs from Server Components in several versions side by side, so one customer on an older .NET release does not block another on the newest one. Customers manage web.config error pages, session state and connection strings on the ASP.NET settings page, and default documents, directory browsing, headers and IP access rules in the IIS settings, without opening a ticket.

Developers publish with Web Deploy from Visual Studio on port 8172, or deploy with Git by pulling from GitHub, GitLab or any server, or by pushing to a repository the panel hosts. Node.js LTS versions run behind IIS through iisnode, inside the site's own application pool. See PHP and ASP.NET.

PHP sites and WordPress on IIS#

Several PHP 8.x versions run side by side, each website choosing its own. The non-thread-safe x64 builds come from windows.php.net and are verified against their published checksums. URL Rewrite 2.1 handles the rules WordPress, Laravel and other PHP applications need.

The WordPress Toolkit installs WordPress, finds copies customers uploaded themselves, updates core, plugins and themes with a restore point first, applies hardening, takes backups and makes staging copies. Joomla, Drupal, phpBB and DNN install in one click, and Composer and a Laravel toolkit cover artisan commands, .env editing, the scheduler and queues.

SQL Server Express and MariaDB in one panel#

SQL Server Express installs as instance SQLEXPRESS on port 1433, and MariaDB for hosted sites on port 3306, separate from the panel's own database. Either engine can be local or a remote server registered in the panel, and a SQL Server Standard edition you already own can be registered instead of Express. Customers create databases and users with Read and write, Read only or Write only access, run queries in the SQL console and open MariaDB in phpMyAdmin with single sign-on. Administrators can view and kill database processes. See databases.

Mail and DNS the Windows way#

MailEnable Standard handles SMTP, POP3, IMAP, mailing lists and DKIM, with mailboxes, aliases, forwarders, auto-replies and quotas managed in the panel and Roundcube on webmail.<domain>. The spam filter uses SPF, DNS block lists, greylisting and optional SpamAssassin; hourly outgoing limits per domain and subscription protect your IP reputation; and Microsoft Defender scans mail queues and mailboxes. See email hosting.

Microsoft DNS Server is installed with recursion off, so it never becomes an open resolver. A zone template sets the records every new domain receives, and administrators control SOA values, zone transfers and who may create subzones. See DNS and FTP.

Security that uses Windows tools#

The panel manages Windows Defender Firewall and rolls a change back automatically if the panel stops answering. IP Address Banning blocks brute-force attempts on Remote Desktop, Windows logons, the panel, FTP, mail and protected folders. ModSecurity for IIS with the OWASP Core Rule Set 4 checks addresses, query strings and headers. Let's Encrypt secures sites and the panel itself, and administrators can use TOTP two-step sign-in and IP access restriction. The security features page covers the rest.

Try it on your own server#

Install with one PowerShell line on a spare Windows Server and use the 10-day free trial with three hosting accounts. Every plan has the same features; the pricing page shows how plans differ by number of accounts, and the comparison shows how StackRegent stands against Plesk for Windows and SolidCP.