Installing Lucee on Windows

January 7th, 2026 by David Simms

Categorized as: Tech Tips

The official documentation for installing the Lucee ColdFusion Markup Language (CFML) server on Windows can be found at Installing Lucee on Windows. That page links to the even more useful guide, Installing Lucee on a Clean Windows 2019 Datacenter with Installer. Both are helpful starting points, but even after following those instructions, you may still need to perform a few additional steps to get the server running smoothly—or, in the case of the infinite loop caused by mod_cfml, running at all.

This article is meant to be a living document. Check back periodically, as the content may update or change over time. The instructions below assume Windows Server 2025 with IIS and Lucee 7, but the concepts are general enough to apply to other Windows and Lucee versions.

Infinite Loop When Accessing `localhost`

Here’s the scenario: You’ve installed IIS on a Windows machine and created your first website. That site contains CFML files, so you proceed to install the Lucee server to process them. You download the Windows installer for Lucee, step through the wizard, open the Lucee welcome page at 127.0.0.1:8888 and access the Lucee Administrator. Everything appears to work.

But when you visit your website at localhost, the request enters an endless loop. The URL often sprouts a repeating pattern of ?_?_?_ until the browser eventually gives up and the request times out.

This typically happens because the installer recommended enabling mod_cfml. As described in the Lucee documentation:

mod_cfml is a web server module that automatically configures your web server to work with Tomcat and Lucee by automatically creating web contexts based on your server’s existing configuration.

In practice, however, relying on mod_cfml can be problematic. Fortunately, it’s not required. Its purpose is simply to inform Tomcat about the IIS website you created—something we can configure manually.

Fix: Install Without mod_cfml and Add a Tomcat Context

Install Lucee without mod_cfml by deselecting it in the installer when prompted to do so.
After installation, open server.xml in a text editor. The location typically is:
{lucee-root}/tomcat/conf/server.xml
Search in that file for:
<Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">
Immediately after this line, add your site’s context with:
<Context path="/" docBase="C:/path/to/your/website/root" reloadable="true" />
Restart the Lucee Windows service:
- Open Services.
- Locate the Lucee service.
- Click Restart.
Visit localhost again. The infinite redirect loop should now be resolved.

Delay in Serving Pages

You may notice that requests to localhost respond slowly, even though the Lucee Administrator loads quickly. This can be resolved with another adjustment to server.xml.

Search in that file for the port value 8009. It will appear inside a <Connector> tag.
Leave all existing attributes in that tag untouched, but add address="::1".
Restart the Lucee service.
Test your pages again. Responses to page requests should now be immediate.

Use JSESSIONID for Session Management

Security frameworks such as OWASP recommend using JSESSIONID for session management, as it is generally more secure than Lucee’s default options.

To enable it:

Open the Lucee Administrator.
Go to Scope Settings.
Under Session Type, select JEE instead of Application.
Click Update to save your changes.

Add the Secure Attribute to JSESSIONID

To ensure that session cookies are only transmitted over HTTPS, configure the secure flag.

Use a text editor to open the file at {lucee-root}/tomcat/conf/web.xml
Search in that file for <session-config>
You will likely see a <session-timeout> entry. Leave it as-is and add a cookie-config node.
Your final <session-config> block should look like:

<session-config>
    <session-timeout>30</session-timeout>
    <cookie-config>
        <secure>true</secure>
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

Setting AES Encryption

Cybersecurity frameworks generally require stronger encryption than Lucee’s defaults. In Adobe ColdFusion, this is configured via JVM arguments. Lucee uses a different JVM property. To configure AES encryption in Lucee:

Run Lucee.exe located at {lucee-root}/tomcat/bin
Under Java Options, add -Dlucee.encryption.algorithm=AES

This ensures the Lucee server uses AES-based encryption algorithms for its cryptographic functions.

Blog