How to Fix “Authorization Error” on IIS Websites Hosted in Plesk

Introduction

Microsoft IIS (Internet Information Services) is a widely used web server for hosting websites on Windows servers. When IIS is managed through Plesk, website administrators occasionally encounter an “Authorization Error” while attempting to access a hosted website.

This issue typically occurs due to incorrect authentication settings, corrupted security configuration files, or synchronization problems between IIS user accounts and Plesk-managed system users. As a result, visitors are unable to access the website, which can lead to service disruption and a poor user experience.

This article explains the common causes of the error and provides step-by-step instructions to resolve it.

Error Message

When accessing the website, the following message may be displayed:

Authorization Error

The website will fail to load, even though IIS services and the website itself appear to be running normally.

Common Causes

The “Authorization Error” can occur for several reasons:

• Anonymous authentication is disabled in IIS.
• The .Security file in the website directory is corrupted.
• IIS user account credentials are not synchronized with Plesk.
• Incorrect website permissions.
• Damaged virtual host configuration.
• Changes made directly in IIS that conflict with Plesk settings.

Understanding the root cause helps administrators resolve the issue more efficiently.

Prerequisites

Before proceeding, ensure you have:

• Administrator access to the Windows server.
• Access to Plesk Administrator Panel.
• Access to IIS Manager.
• Permission to run commands from an elevated Command Prompt.

Resolution

Step 1: Enable Anonymous Authentication in IIS

Anonymous Authentication allows website visitors to access public content without providing credentials.

1. Open Internet Information Services (IIS) Manager.
2. Navigate to the affected website.
3. Open Authentication.
4. Verify that Anonymous Authentication is enabled.

Alternative navigation path:

IIS → Websites → domain.com → Directory Security → Enable Anonymous Access

If Anonymous Authentication is disabled, enable it and apply the changes.

Step 2: Remove the Corrupted .Security File

Plesk creates a hidden .Security file within the website directory. If this file becomes corrupted, IIS may return authorization errors.

Navigate to:

C:\Inetpub\vhosts\domain.com\

Delete the following file:

.Security

Note: Removing this file is safe because it will be recreated during the virtual host reconfiguration process.

Step 3: Reconfigure the Virtual Host

After removing the .Security file, rebuild the IIS configuration for the domain.

Open Command Prompt as Administrator and execute:

"C:\Program Files\Parallels\Plesk\admin\bin\websrvmng" --reconfigure-vhost --vhost-name=domain.com

This command regenerates the website configuration and restores the required security settings.

Step 4: Verify IIS User Account Synchronization

In some cases, the IIS user account password becomes out of sync with the corresponding Plesk system user.

To correct this:

1. Change the password for the domain user within Plesk.
2. Open:

Computer Management
→ Local Users and Groups
→ Users

3. Locate the IIS account:

IUSR_domain

4. Update the password to match the value configured in Plesk.
5. Save the changes.

Password synchronization ensures IIS can correctly authenticate requests.

Step 5: Verify Website Permissions

Check that the IIS user has the necessary permissions on the website directory.

Recommended permissions:

• Read
• Execute
• List Folder Contents

Incorrect NTFS permissions can also generate authorization-related errors.

Step 6: Check Other Hosted Websites

If multiple domains are hosted on the server:

• Verify whether other websites are affected.
• Compare working and non-working site configurations.
• Review recent IIS or Plesk configuration changes.

This helps determine whether the issue is isolated to a single website or affects the entire server.

Final Verification

Once all corrective actions have been completed, execute the following command again:

websrvmng --reconfigure-vhost --vhost-name=domainname.com

Then:

1. Restart IIS.

iisreset

2. Open the website in a browser.
3. Confirm that the Authorization Error no longer appears.

Troubleshooting Tips

If the issue persists:

Review IIS Logs

IIS logs are typically located at:

C:\inetpub\logs\LogFiles\

Check for:

• HTTP 401 errors
• Authentication failures
• Access denied messages

Review Windows Event Viewer

Navigate to:

Event Viewer
→ Windows Logs
→ Application

Look for:

• IIS warnings
• Authentication failures
• Plesk-related errors

Check Plesk Logs

Review Plesk logs for additional information regarding virtual host configuration failures.

Root Cause Analysis

The Authorization Error usually occurs because IIS cannot properly validate or authorize access to the website. In Plesk-managed environments, the problem is commonly linked to:

• Broken security configuration files.
• Authentication settings being modified manually.
• Password synchronization failures.
• Corrupted virtual host configurations.

Reconfiguring the virtual host and restoring authentication settings typically resolves the issue immediately.

Conclusion

The IIS “Authorization Error” is a common issue in Plesk-hosted environments and is generally caused by authentication or security configuration problems. By enabling anonymous access, removing the corrupted .Security file, synchronizing IIS user credentials, and rebuilding the virtual host configuration, administrators can quickly restore website accessibility.

Following the troubleshooting steps outlined in this guide will help ensure stable IIS operation and minimize downtime for hosted websites.