# Fix ASP.NET and IIS errors on Windows hosting

> Find the cause of ASP.NET errors on Windows hosting: read the 500.xx sub-code, turn on the ASP.NET Core stdout log, fix web.config and SQL Server errors.

Difficulty: Intermediate

On Windows hosting your site runs on **IIS**. When a request fails, IIS shows an HTTP status with a **sub-code** after the dot, such as **500.19** or **500.30**. That sub-code tells you where to look. This guide covers the codes you meet most often and how to read the details.

## Step 1: Note the exact code

Open the failing page and note the full code and any HRESULT value (for example `0x8007000d`). Then make the details visible:

**ASP.NET Core**

1. In `httpdocs`, create a folder named `logs`.
2. In `web.config`, set `stdoutLogEnabled="true"` and `stdoutLogFile=".\logs\stdout"` on the `aspNetCore` element:

```xml
<aspNetCore processPath="dotnet"
      arguments=".\MyApp.dll"
      stdoutLogEnabled="true"
      stdoutLogFile=".\logs\stdout" />
```

3. Reload the page and open the newest `stdout_….log` file in `logs`.
4. Set `stdoutLogEnabled="false"` again when you are done.
**ASP.NET (.NET Framework)**

Turn custom errors off for a moment so that ASP.NET shows the full exception. In Plesk, use the domain's **ASP.NET Settings**, or set this in `web.config`:

```xml
<system.web>
  <customErrors mode="Off" />
</system.web>
```

Set it back to `RemoteOnly` or `On` as soon as you have the message: the details are visible to everyone.

> **Warning**
>
> The stdout log has no limit on size or number of files. Leaving it on can fill your disk space and stop the site.

## 500.19: configuration data is invalid

IIS cannot read `web.config`. The HRESULT names the reason:

| HRESULT | Cause | Fix |
|---|---|---|
| `0x8007000d` | Malformed XML, or a section for a module the server does not have (for ASP.NET Core: the hosting bundle for your version) | Check the line named in the error; remove sections you do not need; ask us about the .NET version |
| `0x80070021` | The section is locked at server level and cannot be set in your `web.config` | Remove that section from `web.config`, or ask us whether the setting can be changed for you |
| `0x800700b7` | A duplicate entry for a setting that is already defined higher up | Remove the duplicate entry from your `web.config` |
| `0x80070003` | IIS cannot read the configuration file at the site's path | Make sure `web.config` is in `httpdocs` |

## 500.30, 500.31 and 502.5: the app does not start (ASP.NET Core)

- **500.31 Failed to Find Native Dependencies:** the .NET runtime your app targets is not installed on the server. Target a version the server has, or publish self-contained. Ask us which versions are available.
- **500.30 In-Process Startup Failure:** the app fails while starting. The stdout log shows the exception, often a missing setting or a failed database connection at start-up.
- **502.5 Process Failure:** the app's process does not start, often for the same reason as 500.31.
- **500.32 Failed to Load dll:** the app was published for a different processor architecture (for example 32-bit against 64-bit). Republish framework-dependent, without a runtime identifier.

## 403.14 Forbidden: the directory listing is denied

IIS found no application and no default page. Usually the deployment is incomplete: the files are in the wrong folder, some were not copied, or `web.config` is missing. Upload the complete publish output into `httpdocs`.

## SQL Server: "The certificate chain was issued by an authority that is not trusted"

Since `Microsoft.Data.SqlClient` 4.0, connections are encrypted by default and the driver checks the server's certificate. If your app cannot verify it, the connection fails with this message.

- Ask us in a ticket for the recommended connection settings for your server.
- To connect with encryption but without checking the certificate, add `TrustServerCertificate=True` to the connection string. Microsoft notes that this leaves the connection open to interception, so treat it as a temporary step.

**Login failed for user.** The user name or password in the connection string does not match the database user in Plesk, or the user is not assigned to that database. Set a new password for the user in Plesk and update the connection string.

## Next steps

- Deploying again: [deploy an ASP.NET site with Plesk](/guides/deploy-aspnet-plesk).
- Before each release: [back up and restore your hosting account](/guides/hosting-backup-restore).

## Frequently asked questions

### Why do I only see a generic error page?

IIS and ASP.NET hide error details from visitors on purpose. Use the stdout log (ASP.NET Core) or turn custom errors off for a moment (ASP.NET) to see the real message.

### The app works on my computer but not on the hosting. Why?

Most often the .NET version on the server differs from the one you target, a setting such as the connection string still points to your computer, or a file is missing from the upload.

### Can I see the Windows event log or IIS Manager?

Not on shared Windows hosting; we manage the server. Plesk shows your site's web server logs under Logs. For more, send us the time and address of the failing request in a ticket.

### Can I leave the stdout log on?

No. Microsoft warns that it has no size limit and can fill the disk. Turn it on to find a problem, then off again.

---

Source: <https://hyperdc.com/guides/products/aspnet-iis-errors>\
Updated: 2026-10-15