> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/installation.md).

# Installation

Before you start, make sure the server meets the [Requirements](/forestall/introduction/requirements.md).

1. Log in the [**license.forestall.io**](https://license.forestall.io/) with given credentials.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f7497a9c3da3c6ab027428b64b01af733f85edd3%2Fintroduction-installation-image-1.png?alt=media" alt="Forestall License Portal login page"><figcaption><p>Forestall License Portal</p></figcaption></figure>

2. Download the license file from [**Licenses** ](https://license.forestall.io/licences/)page.
3. Download the installation package of last release from [**Releases** ](https://license.forestall.io/releases/)page.
4. Run the installation package with **Administrator privileges** on the deployment server. The installer and binaries are signed with an EV code-signing certificate. You can check the signature in the file's **Properties > Digital Signatures** tab before running it.

{% hint style="warning" %}
Install Forestall on a domain-joined server. Some checks need domain membership, so a server outside the domain gives incomplete results. See [Requirement 7](/forestall/introduction/requirements.md).
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-e415b035fa51e2736cfabf42d759cd81139d9990%2Fintroduction-installation-image-3.png?alt=media" alt="Running the installation package as administrator"><figcaption><p>Running Installation Package</p></figcaption></figure>

5. Click **Next** button to install requirements first.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-64d54a8561fc94c416df99784b19c1d790d4bdbd%2Fintroduction-installation-image-4.png?alt=media" alt="Prerequisites welcome page of the installer"><figcaption><p>Installing Forestall Requirements</p></figcaption></figure>

6. The package installs the prerequisites that are missing on the server:

   * **.NET Framework 4.7.2**
   * **Java(TM) Platform SE 15**, used by the Neo4j graph database
   * **Python 3.13 (64-bit)**, installed to `C:\Python`
   * **PostgreSQL 15**, installed under the installation folder (`PostgreSQL\15`)
   * **IIS URL Rewrite 2.1** (see step 10)

   The **Neo4j 4.4.8** graph database is bundled with Forestall and installed under the installation folder. It does not need a separate download. The installer also enables the `pgvector` extension in PostgreSQL, which the AI Assistant uses.
7. Click **Next** to install Forestall services.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-7ea2dfa1ad5a6fe36aa90ddc30004e4520eb3ffd%2Fintroduction-installation-image-6.png?alt=media" alt="Welcome page of the Forestall installer"><figcaption><p>Installing Forestall</p></figcaption></figure>

8. Select the **installation folder** and click **Next**. The default folder is `C:\Forestall\FSProtect\`.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-395561d11c948ae47eb43c225b83b3c95efa5cb1%2Fintroduction-installation-image-8.png?alt=media" alt="Select Installation Folder page with C:\Forestall\FSProtect\"><figcaption><p>Forestall Installation Folder</p></figcaption></figure>

9. Click the **Install** button to start the installation.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-401d580f373338990501dfa14e2af43734035949%2Fintroduction-installation-image-9.png?alt=media" alt="Ready to Install page of the installer"><figcaption><p>Starting the Installation</p></figcaption></figure>

10. After installation is finished, package installs the **IIS URL Rewrite Module**. To install this module **Accept the License Agreement** and click **Install**.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-43b68ab2a520f26d3374be1594ccf6d4b652c04a%2Fintroduction-installation-image-10.png?alt=media" alt="IIS URL Rewrite Module license agreement"><figcaption><p>Installing the IIS URL Rewrite Module</p></figcaption></figure>

11. Click the **Finish** button to complete installation.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-3a628abb8d89b78544a646598bc667bbad4d7951%2Fintroduction-installation-image-11.png?alt=media" alt="Installation completed page"><figcaption><p>Finishing the Installation</p></figcaption></figure>

12. The installer configures HTTPS for all Forestall sites in IIS:

| Site                 | Port | Purpose                                                   |
| -------------------- | ---- | --------------------------------------------------------- |
| `FSProtect-Frontend` | 443  | Web interface. Port 80 stays open and redirects to HTTPS. |
| `FSProtect-Django`   | 8443 | REST API, called by the web interface and by API clients. |
| `FSProtect-Core`     | 5443 | Core service, called by the REST API on the same server.  |

If the server has no certificate for its host name, the installer creates a self-signed certificate (`Forestall Self Signed Certificate`, valid for 10 years) and trusts it on the server. A **Forestall** shortcut on the desktop opens `https://<server IP address>`. Browsers on other computers show a certificate warning until you replace the certificate (see [Changing the certificate and address](#changing-the-certificate-and-address)).

{% hint style="info" %}
The default username and password for the web interface are both **`forestall`** (lowercase). Change the password after the first login.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-faf5eef432bb7154feaed56ca33565be918a2b28%2Fintroduction-installation-image-12.png?alt=media" alt="Forestall login page"><figcaption><p>Logging In the Forestall Web Interface</p></figcaption></figure>

13. Until a license is installed, the web interface opens only the **About > License** page. Upload the license file you downloaded in step 2 to start scanning. See [About](/forestall/about.md) for the license table and multi-license details.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-0a5a6dc74dfc275e505b4086978cb807ae561c3d%2Fabout-license-tab.png?alt=media" alt="About page, License tab with the license upload area"><figcaption><p>Uploading the License</p></figcaption></figure>

14. Change the default password: open the avatar menu in the upper-right corner and select **Profile**. See [Profile](/forestall/profile-menu/user-settings.md).

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f7a93af2a21e73b9f545491c90b5aea2f6a033c8%2Fnavigating-profile-menu.png?alt=media" alt="Avatar menu with Profile, API Tokens and Logout"><figcaption><p>Opening the Profile Page</p></figcaption></figure>

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-c3a4d901f5154319e72d97ce6863183eda46e9da%2Fintroduction-installation-image-15.png?alt=media" alt="Profile page with the password change form"><figcaption><p>Changing the Password</p></figcaption></figure>

15. Configure the environments you want to scan in [Configuration Center](/forestall/configuration-center.md), then start a scan from **Scans > New Scan**.

## Changing the certificate and address

The installer copies maintenance scripts to `C:\Forestall\FSProtect\setup-files\scripts\utils\`. Run them in an elevated PowerShell session.

* `Change-Certificate.ps1`: lists the certificates in the computer's personal store and binds the one you select to the Forestall sites. Import your certificate into `Cert:\LocalMachine\My` first.
* `Change-IpAddress.ps1`: updates the address the web interface, API and Core use to reach each other. Set `$NEW_ADDRESS` at the top of the script to the new IP address or host name before running it.
* `Set-IIS-SecurityHardening.ps1`: removes the HTTP response headers that disclose server and framework versions.
* `Backup-All.ps1`: backs up the databases, reports and configuration files (see [Update](/forestall/introduction/update.md#before-you-update)).