You’ll need to apply IIS_IUSRS group read access to wwwroot, project, virtual but not base. The trick is to only apply to the current folder, i.e. don’t apply to subfolders and files.
src - https://stackoverflow.com/a/34797333
origin - https://www.pipiscrew.com/?p=18557 iis-pending-requests-for-ever