Before the first deployment
- Dedicated application pool with a least-privilege identity
- Separate site bindings for HTTP and HTTPS, with HTTP redirecting
- Request limits and timeouts reviewed against the application
Certificates
- Install the full chain, not just the leaf certificate
- Set a renewal reminder well before expiry
- Verify with an external SSL checker after every renewal
After deployment
- Confirm the application writes logs where you expect
- Take a backup and restore it somewhere before you need it
- Add the site to uptime monitoring with alerting to a real inbox
The last point is the one most often skipped. A backup you have never restored is a hypothesis, not a backup.