How to Install phpMyAdmin on IIS in Windows 11 or Windows Server 2022?

7.4K

In this guide, we’ll show how to install phpMyAdmin on IIS running on Windows Server 2022/Windows 11 using a modern PHP/FastCGI config suitable for administrative and internally managed environments.

Note that recommendations below also apply to modern PHP 8.3+ deployments, PHP 8.2, IIS FastCGI hardening, HTTPS configuration, and secure remote access practices.

Before Installing phpMyAdmin

Do you manage MySQL servers and databases? If so, you know the pain of managing them via the command line. If you ever wished for a GUI-based management tool for MySQL, then you should consider phpMyAdmin: everything you can do from the MySQL command line, you can do in phpMyAdmin.

Requirements for phpMyAdmin

Before installing phpMyAdmin on IIS, you need to ensure that your environment meets the following requirements:

• Supported software versions
• Windows Server 2022/Windows 11
• IIS with CGI/FastCGI support enabled
• PHP 8.4 or later, using the Non-Thread-Safe (NTS) build for IIS FastCGI
• MySQL 8.x/MariaDB
• Visual C++ Redistributable for PHP runtime support
• Recommended production requirements

In case you are working with production/internet-accessible deployments, Microsoft and IIS security best practices recommend:

• You should enable HTTPS/TLS on the IIS website
• You need to restrict phpMyAdmin access using firewall rules, VPN, or IP restrictions
• You should run phpMyAdmin behind authentication controls
• Using least-privilege MySQL accounts instead of the MySQL root account
• Regularly updating PHP, MySQL, and phpMyAdmin versions
• Security considerations

Keep in mind that phpMyAdmin is a high-value admin interface frequently targeted by:

• Automated vulnerability scanners
• Brute-force attacks
• Credential stuffing
• Remote code execution exploits against outdated PHP/phpMyAdmin versions

Because of this, we don’t recommend to expose phpMyAdmin directly to the internet in enterprise environments.

Step 1: Enabling the IIS Web Server

phpMyAdmin is a website written in PHP. In this case, your IIS installation must be PHP-capable for installing the phpMyAdmin website. The default IIS installation plus the CGI support should suffice.

You may skip this step if you already have an existing IIS web server installation.

Enable IIS on Windows Server (2016, 2019, 2022)

If you’re using Windows Server 2016 to 2022, you can enable the base IIS web server feature with CGI by running this command in PowerShell as admin.

Install-WindowsFeature -Name Web-Server, Web-CGI -IncludeManagementTools

Open your browser and confirm the default IIS home page loads:

HTTP://localhost 
HTTP://<hostname> 
HTTP://<hostname.domain.tld>

Enable IIS on Windows 10 or 11

The base IIS installation with CGI on Windows Desktop uses a different command with different feature names. Run the command below in PowerShell as admin.

Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServerRole, IIS-CGI

Note. Optionally, you can add C:\Windows\System32\inetsrv to the system PATH environment variable for easier command-line access to IIS management tools (such as inetmgr.exe).

Open your browser and confirm the default IIS home page loads:

HTTP://localhost
HTTP://<hostname>
HTTP://<hostname.domain.tld>

At this stage, HTTP is sufficient for basic IIS validation. Later in this guide, we’ll configure HTTPS before publishing phpMyAdmin.

Step 2: Installing PHP Support in IIS

Assuming that IIS is now enabled and running, the next step is to install PHP support in IIS. This step is crucial for phpMyAdmin to run on your IIS web server.

Download and Extract PHP for IIS

1. Download the latest supported PHP Non-Thread-Safe (NTS) build for Windows from https://windows.php.net/download/. For IIS deployments, Microsoft and PHP documentation generally recommend using the Non-Thread-Safe (NTS) version together with FastCGI.
   

   

2. Download a currently supported PHP 8.x NTS x64 build. Do not use an end-of-life or unsupported PHP release. Once downloaded, export the ZIP file to your preferred folder. For example, I’m extracting the contents to C:\PHP using PowerShell.
   

   mkdir C:\PHP 
   
   Expand-Archive `
   -Path ~/Downloads/<php-8.x.x-nts-Win32-vs17-x64.zip> `
   -DestinationPath C:\PHP

   

   Feel free to do this using File Explorer if you prefer. Optionally, you can add the PHP installation folder to the system PATH environment variable. This will make access to PHP binaries easier from PowerShell/Command Prompt.

   

CGI vs FastCGI in IIS

Keep in mind that IIS supports running PHP through both CGI and FastCGI. In modern environments, you should always prefer FastCGI because it provides:

• significantly better performance
• process reuse
• lower PHP startup overhead
• improved scalability
• better production stability

Although the CGI Windows feature is enabled during setup, note that IIS actually runs PHP using the FastCgiModule handler mapping (we will configure it later in this guide).

For production environments, you should consider FastCGI as the standard and recommended config for PHP on IIS.

Create the PHP Initialization File

The PHP initialization filename is php.ini, located in the PHP installation folder, which, in this case, is C:\PHP\php.ini. This file does not exist by default, although the sample templates exist, namely php.ini-development and php.ini-production.

1. In this example, we’ll create a copy of the production initialization file and name it php.ini:
   

   # Change the working directory to the PHP installation folder 
   
   Push-Location C:\PHP\ 
   
   # Copy php.ini-production to php.ini 
   
   Copy-Item .\php.ini-production .\php.ini

   
2. Open the php.ini file in a text editor. In this example, I’m using Visual Studio Code.
   code .\php.ini
3. Locate and uncomment the following lines by removing the semi-colon before each line:
   

   extension_dir = "ext"
   extension=mbstring
   extension=mysqli
   extension=openssl
   extension=zip
   extension=gd
   extension=curl
   extension=xml

   

   Here you need to enable the PHP extensions required by phpMyAdmin and by the features you plan to use. At minimum, mysqli is required to connect to MySQL. mbstring, zip, gd, openssl, curl, and XML support are commonly required/recommended for specific phpMyAdmin features:

   php -m

Add Handler Mappings for PHP

Next, let’s configure the handler mapping for PHP in IIS. A handler mapping tells IIS how to handle a request path. In this example, we’re adding the handler mapping for “*.php”.

1. First, download and install the Visual C++ Redistributable.
   

   

2. Open the IIS Manager by running this command:
   

   inetmgr.exe

3. Double-click the Handler Mappings feature.
   

   

4. Click the Add Module Mapping in the Actions pane.
   

   

5. Enter the following details in the Add Module Mapping window and click OK to save the module mapping.
   • Request path: *.php
   • Module: FastCgiModule
   • Executable: C:\PHP\php-cgi.exe
   • Name: PHP
     

     

6. Click Yes on the next prompt to confirm creating the PHP module mapping.
   

   

   The PHP handler mapping has been created.
   

   

You can config PHP FastCGI Mapping with AppCmd (it’s optional):

%windir%\system32\inetsrv\appcmd set config `
/section:system.webServer/fastCgi `
/+"[fullPath='C:\PHP\php-cgi.exe']"

%windir%\system32\inetsrv\appcmd set config `
/section:system.webServer/handlers `
/+"[
name='PHP-FastCGI',
path='*.php',
verb='*',
modules='FastCgiModule',
scriptProcessor='C:\PHP\php-cgi.exe',
resourceType='Either'
]"

Recommended IIS FastCGI Hardening

For production IIS deployments, we recommend you to apply the following FastCGI hardening recommendations:

• You should disable unnecessary PHP functions. Edit php.ini and disable dangerous functions if they are not required:
  disable_functions=exec,passthru,shell_exec,system
• You need to hide PHP version disclosure (expose_php = Off)
• You should limit upload sizes (upload_max_filesize = 32M, post_max_size = 32M)
• You need to restrict PHP execution directories. You need to avoid allowing PHP execution inside upload/temporary directories.
• Enable detailed IIS logging. You should keep IIS request logging enabled for troubleshooting and security auditing purposes.

Restrict Dangerous File Access with IIS Request Filtering

Note that you need to prevent direct access to sensitive phpMyAdmin and PHP-related files whenever possible. In IIS Request Filtering, you should consider blocking access to:

• config backups
• .log files
• .ini files
• composer files
• temp files

Add Default Document for PHP

Now let’s add a default document entry for PHP.

1. Click the IIS computer name on the left pane and double-click the Default Document feature.
   

   

2. Click Add under the Actions pane, type “index.php”, and click OK.
   

   

3. Switch back to your PowerShell window and restart the IIS web server by running this command.
   

   iisreset

   

Test PHP on IIS

To test whether IIS can now run PHP, let’s create a new file called phpinfo.php in the IIS root folder.

'<?php phpinfo(); ?>' | Out-File C:\inetpub\wwwroot\phpinfo.php -Encoding utf8

Open your browser and navigate to any of these URLs.

HTTP://localhost/phpinfo.php 
HTTP://<hostname>/phpinfo.php 
HTTP://<hostname.domain.tld>/phpinfo.php

The following webpage will be displayed, confirming that your PHP setup in IIS is working. After testing PHP functionality, you should immediately remove the phpinfo.php test file from the IIS root (as it exposes sensitive PHP environment and config details).

Secure IIS with HTTPS Before Publishing phpMyAdmin

Before exposing phpMyAdmin to users, you should secure the IIS website with HTTPS/TLS encryption.

Note that without HTTPS:

• MySQL credentials may be exposed over the network
• session cookies may be intercepted
• browser security warnings may appear

As for the minimum, we recommend production deployments to use:

• a trusted TLS certificate
• HTTPS bindings in IIS
• automatic HTTP-to-HTTPS redirection

You can config HTTPS bindings in IIS Manager under by navigating to Sites → Bindings → Add → HTTPS.

Step 3: How to Install phpMyAdmin on IIS

Now that IIS and PHP are configured, it’s time to install phpMyAdmin.

Download and Extract phpMyAdmin

1. Navigate to the phpMyAdmin downloads page using your browser.
2. Download the latest “all-languages” variant. As of this writing, the newest version is phpMyAdmin-5.2.3-all-languages.zip.
   

   

3. Once downloaded, extract the contents to the IIS root (c:):
   

   Expand-Archive -Path ~/Downloads/phpMyAdmin-5.2.3-all-languages.zip -DestinationPath c:\inetpub\wwwroot\

   
4. After the extraction, a new subfolder, phpMyAdmin-<version>-all-languages, is created. Let’s rename it to phpMyAdmin.
   

   Rename-Item C:\inetpub\wwwroot\phpMyAdmin-5.2.3-all-languages phpMyAdmin

   

Create a Configuration File

phpMyAdmin requires a configuration file to function properly. Instead of creating this file manually, we can use the built-in phpMyAdmin setup page to generate it.

1. Visit the phpMyAdmin setup page at https://localhost/phpmyadmin/setup/.
2. Click New server.
   

   

3. Enter the Server hostname. Valid values are:
   • Hostname — “localhost”, “db1.theitbros.com”.
   • IP v4 address.
   • IP v6 address.
   • dot “.” — for named pipes on Windows.
   • empty “” — server is disabled.
     Click Apply.
     Note. If your MySQL server uses a non-default port, you must specify it here.
     

     

4. The server is now listed in the configuration. Click Download to download the configuration file.
   

   

5. Copy the downloaded config.inc.php file to the C:\inetpub\wwwroot\phpMyAdmin folder.
   

   

Warning. After generating config.inc.php, the best practice is to remove/restrict access to the setup directory immediately:

Remove-Item "C:\inetpub\wwwroot\phpMyAdmin\setup" -Recurse -Force

Note that the setup folder should not remain accessible after installation, it can expose sensitive config functionality to attackers.

Security Risks of Exposing phpMyAdmin to the Internet

phpMyAdmin is one of the most commonly targeted web admin tools on the internet. Note that the attackers frequently scan for:

• /phpmyadmin
• outdated PHP versions
• weak MySQL credentials
• publicly accessible admin panels

For enterprise environments, we strongly recommend you to restrict phpMyAdmin access using one or more of the following methods:

• VPN-only access
• IIS IP address restrictions
• reverse proxy authentication
• internal network access only
• multifactor authentication (MFA)

Note that you should avoid exposing phpMyAdmin directly to the public internet whenever possible.

You can additionally change the default /phpmyadmin URL path to reduce automated scanning noise. Keep in mind that it is not a replacement for proper security controls, but it may help reduce opportunistic scanning activity.

Step 4: Create a MySQL User for phpMyAdmin

At this point, phpMyAdmin is installed. To access it, navigate to HTTPS://localhost/phpmyadmin. If you log in using the root account, you will get the following error message:

This error happens because the root account can only log on to the local host, and that’s probably best for security. The logical step is to create another MySQL user account that we can use with phpMyAdmin.

1. Log in to your MySQL server and open the MySQL command line client. You can do so from the Start menu.
   

   

   Or from the command line.
   

   & "C:\Program Files\MySQL\MySQL Server 8.0\bin\mysql.exe" -u root -p

   

   If on Linux, run sudo mysql -u root -p.

2. Run the below command to create a dedicated MySQL account for phpMyAdmin access. Replace USERNAME and PASSWORD accordingly. Note that you should avoid using % host wildcards whenever possible. Instead, restrict MySQL logon hosts to specific IP addresses, management servers, or internal subnets.
   

   Warning. You should avoid granting global admin privileges unless absolutely necessary. In production environments, you need to follow the principle of least privilege and grant access only to the required databases.For local phpMyAdmin access only:

   CREATE USER 'phpmyadmin_user'@'localhost' IDENTIFIED BY 'StrongPassword';

   Keep in mind that modern MySQL 8 deployments use caching_sha2_password authentication by default. In most cases, you should avoid forcing mysql_native_password (unless you require it for compatibility with older apps/drivers).In case phpMyAdmin is hosted on a separate management server, you need to replace localhost with the specific management host IP address/subnet (instead of using the % wildcard whenever possible).Next, grant the user the required privileges on the target database:

   GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX
   ON database_name.*
   TO 'phpmyadmin_user'@'localhost';

   The WITH GRANT OPTION permission allows the account to grant privileges to other users. Note that you should generally avoid it unless the account is intended for admin delegation.

3. Quit the MySQL client by running quit.
4. Reconnect to MySQL using the new account to test if it works. Replace USERNAME as needed.
   

   & "C:\Program Files\MySQL\MySQL Server 8.0\bin\mysql.exe" -u USERNAME -p

   

Step 5: Log in to phpMyAdmin

Now that we have the dedicated MySQL admin account, let’s test it with phpMyAdmin.

1. On the computer where you installed phpMyAdmin, navigate to HTTPS://localhost/phpMyAdmin.
2. Log in using the new MySQL user account you created.
   

   

3. You can now manage your MySQL server using the phpMyAdmin interface.
   

   

Restrict Access to phpMyAdmin in IIS

Note that in production environments, you should restrict access to the phpMyAdmin website. You can limit access in IIS using:

• Windows Firewall rules
• IIS IP Address and Domain Restrictions
• VPN access
• reverse proxy access controls

For example, many organizations allow phpMyAdmin access only from:

• internal admin workstations
• jump servers
• VPN networks

Such approach will help you to significantly reduce exposure to automated attacks and credential scanning.

Keep phpMyAdmin Updated

Because phpMyAdmin is frequently targeted by attackers, you should regularly monitor and install security updates for:

• PHP
• phpMyAdmin
• MySQL/MariaDB
• Visual C++ Redistributable components

In case you run outdated phpMyAdmin/PHP versions, this can significantly increase exposure to publicly known vulnerabilities and remote code execution exploits.

Wrapping Up

phpMyAdmin remains one of the most widely used web-based MySQL admin tools for IIS and Windows environments. However, because phpMyAdmin exposes privileged database management functionality through a web interface, in production deployments you will require careful hardening and restricted access controls.

You should prioritize:

• HTTPS/TLS protection
• restricted network exposure
• least-privilege database accounts
• You need to perform regular PHP/phpMyAdmin updates
• IIS and FastCGI hardening

For enterprise environments, you can additionally place phpMyAdmin behind VPN access, reverse proxies, or dedicated administrative management hosts to reduce attack surface.