Here is a short and sweet list of free IIS security tools by Kevin Beaver @ TechTarget (he wrote the classic Hacking for Dummies):
http://searchsecurity.techtarget.com.au/articles/24798-Free-tools-to-improve-IIS-security
Port80's HeaderCheck and other free HTTP analysis tools are mentioned in there as well (toot-toot goes the horn), but it is a useful list of tools. And free is nice, given the price of gas and all!
Cheers,
Port80
PS Our Deal Packs are not “free“, but they are a little lighter on the ol' budget -- check them out at http://www.port80software.com/deals/.