(and I regretted it just enough to keep going)

Before we start, I have to preface that:

I didn't start this project because it made sense,

and I definitely didn't start it because it was a good idea.

This entire """project""" began as a joke I took too seriously, in the same kind of way of "what if", that should've stayed a passing thought.

But instead, it turned into hours and days of me fighting a system that clearly did not want to exist anymore.

Take notice of this, this is will be a trend throughout this blogpost.

The idea

It was simple on paper:

• take Classic ASP
• run it on IIS 5.1
• expose it to the modern internet using a reverse proxy using Caddy and Cloudflare

(I can tell that half of the readers have already shouted "WHAT THE FUCK IS WRONG WITH YOU??" at the screen.)

That sentence alone should have been enough of a teeth-grinding warning sign, but at the time it just sounded funny to me.

But! Even if it's a stupid enough thought, there was also a more honest motivation behind it.

I genuinely cannot stand what the modern web has turned into.

Everything feels bloated, over-blown, and disconnected from actual user experience.

You load a page and your browser spins up like you just launched Cyberpunk 2077, only to display content that could have been delivered as a static HTML file like twenty years ago.

Searching for anything drops you into a maze of AI-generated pages that all say the same thing in slightly different ways,

wrapped in animations, ads and tracking scripts that make even simple tasks feel heavy.

So instead of adding to that pile, I wanted to go in the opposite direction.

I wanted constraints and limitation.

I wanted something that would force me to understand what was happening instead of hiding everything behind frameworks and tooling.

Classic ASP seemed perfect for that, not because it's good (lol),

but because it refuses to pretend to be.

The obvious problem: Documentation.

Nothing about this stack from 2001 is designed to be rediscovered in 2026. (25 years later 😭)

Setting up IIS 5.1 isn't just "read some old documentation",

it's documentation that assumes you already know how IIS works.

You don't get guided setup instructions or modern explanations; you get fragments of information scattered across outdated Microsoft pages and forum posts that end with "fixed it" and no explanation of how.

XKCD: 979, Wisdom of the Ancients

One of the first things that completely derailed me was something as simple as the Windows Account IUSR_MACHINENAME.

Every guide casually tells you to assign permissions to it, but none of them explain what it actually is in a way that makes sense if you've never touched IIS before.

I genuinely thought I was supposed to log into it at first with a Windows User Account. 😭

In reality, it's a machine-level guest account that IIS uses to execute requests, which sounds obvious in hindsight but is never presented clearly when you're learning it.

That moment set the tone for everything else: the system assumes knowledge you don't have, and it punishes you for not having it.

Once you get past that initial confusion, you start running into how IIS 5.1 actually behaves,

and that's where things get properly uncomfortable.

What became abundantly clear was that it's built on completely different assumptions.

Request handling is fragile, long-running scripts can block the entire process, and there's no meaningful concept of modern async behavior.

If something goes wrong, you're often left staring at a 500 error with no logs and no explanation, which turns debugging into a process of elimination rather than understanding.

Classic ASP itself doesn't help much here either.

It runs through ISAPI extensions, which introduces another layer where things can silently fail.

If something is misconfigured or missing, you don't get a helpful error message; you get nothing.

The system doesn't guide you toward a fix, it just stops working and waits for you to figure it out.

All of that would already be enough to make this a painful project, but the real breaking point came from trying to integrate it into a modern stack.

Running IIS 5.1 on its own is one thing, but putting it behind a reverse proxy and exposing it through a modern CDN layer is where everything starts conflicting.

Using Caddy was supposed to simplify things, and to its credit, it did more than something like nginx would have in this situation.

It handled TLS cleanly and made reverse proxying relatively straightforward,

but that only works if your backend behaves in ways the proxy expects.

IIS 5.1 does not.

Suddenly, headers became one of the most important and fragile parts of the entire setup.

• Forwarding the correct Host header was necessary for ASP to behave properly
• X-Forwarded-For needed to be injected manually for anything resembling accurate logging
• Certain headers like X-Forwarded-Proto actually had to be removed because they would confuse the backend

Every small mismatch had the potential to break everything,

and when it did break, the feedback loop was almost nonexistent.

You wouldn't get a clear indication of what went wrong; you would just get another 500 error and have to start guessing again.

Cloudflare

(notice how this is it's own topic?)

Adding Cloudflare into the mix made things even more unstable.

Cloudflare is designed with the assumption that your origin server behaves like a modern application, which means it applies optimizations and security checks that make perfect sense in that context but completely fall apart when pointed at something like IIS 5.1.

Features like caching, browser integrity checks, and proxy-level filtering started interfering with perfectly normal requests, causing inconsistent behavior that was almost impossible to trace back to a single cause.

At some point, I realized that trying to make Cloudflare "work properly" was a losing battle, so I stripped it down to the bare minimum.

• Proxying was disabled
• Most of the smart features were turned off

It was reduced to essentially DNS with a few extra steps.

That wasn't the original plan, but it was the only way to stop it from actively breaking things.

Can AI help?

(Please don't stop reading; I will explain I promise😭)

One of the more frustrating parts of this entire process was realizing that AI "tools" (using tools lightly here, I have very strong opinions about AI) were not just unhelpful, but actively misleading and sabotaging my work. Unlike what others might say.

Someone had recommended me to try using Claude for the first time.

This was the first time I seriously tried to use it as a support tool to fix a bug I had overlooked,

and it consistently failed in ways that made things worse.

It would assume I was working with ASP.NET instead of Classic ASP, suggest configurations for newer versions of IIS that simply do not exist in 5.1,

and confidently recommend changes that would have broken the system even further.

The inconsistency was the worst part; asking the same question twice could AND would produce completely different answers, both of them wrong in different ways.

Eventually and rather quickly, I stopped using them entirely.

That tech-bros would even consider them a tool is INSANE to me because it has been the most useless experience TO DATE that I've had the displeasure of using.

It was extremely naive of me to believe it would've been a help, but it only added to my hate for AI.

Fuck AI. Save our Water for useful things. Like drinking. 🚰

"Security"

Security became a concern much faster than I expected,

mostly because the moment the server was reachable, people and AIs started poking at it.

Classic ASP and IIS 5.1 were not designed for the current internet, and it shows immediately.

There are no built-in protections against the kind of automated traffic and scraping that is normal today, so I had to start implementing basic defenses myself.

That meant learning about:

• input validation
• request filtering
• simple anti-bot measures

in a context where there is no framework to fall back on.

Everything has to be done manually, and every mistake is yours.

I was able to implement basic features and light security, but it's not 100%.

(Please don't test it😭)

The bad.

The bugs that came out of this setup were the kind that make you question whether you actually understand anything at all.

The most common one was the completely silent 500 error, where the server fails without producing any useful output.

Debugging that involves stripping things down piece by piece until something changes, which doesn't necessarily mean it's fixed,

just that it's behaving differently.

Permissions were another constant source of problems, and every time I thought I had a solid understanding of how they worked,

something new would break in a way that didn't match what I had just learned.

Even outside of the server itself, the environment added its own layer of difficulty.

Working on Windows XP in 2026 means dealing with outdated tools, limited compatibility, and workflows that feel like they belong to a different era.

FTP editing quickly became unusable, so I had to set up RDP access just to make basic changes efficiently.

Finding software that still runs properly on the system meant digging through old versions of editors and browsers, and testing in Internet Explorer 6 wasn't optional,

it was necessary to see how things actually behaved without modern browsers smoothing over the rough edges.

At some point, after enough small fixes and adjustments, the system started working.

There wasn't a single breakthrough moment where everything suddenly made sense; it was more like a gradual shift where fewer things were breaking at the same time.

Eventually, a request would go from the client, through Cloudflare, into Caddy, reach IIS, execute an ASP script, and return a response without failing somewhere along the chain.

That moment didn't feel dramatic, but it felt significant because of how many things had to line up for it to happen.

This setup is not practical by modern standards.

It isn't scalable, it isn't particularly secure, and it definitely isn't efficient.

But it forced me to understand parts of the web stack that are usually hidden behind layers of abstraction, and it made every small success feel earned in a way that modern tooling rarely does.

If nothing else, it proved that even something as outdated as IIS 5.1 can still be made to function in a completely different era, as long as you're willing to deal with everything it refuses to handle for you.

Do I recommend you go out and do this? Fuck no, it was a pain in the ass and made no sense until it all worked out in my favor.

But for the sake of learning, yes! It's fun to limit yourself and to get more familiar with old software. There is something that modern software will never replace, and it's the feeling of success when you are so used to comfort-ability.

And honestly, I think that's kind of the appeal of such a project.

Much love,

claire.

check out scape, see for yourself! scape.supitszaire.com

liked reading this blog? consider adding it to your rss feed and supporting me on ko-fi💕!

even buying my album would help me tons in my endeavours and you get cool sounds straight to ur ears! WHAT NOW?