Blocking access to files with IIS Manager

Some customers have asked what is the best way to prevent visitors from accessing certain files on their sites. The solution we generally recommend is what I am going to cover in this article.

First you will need to connect to your site through IIS Manager and the instructions can be found here: https://support.winhost.com/kb/a628/using-the-microsoft-iis-manager.aspx

Once you have made a successful connection you should get a screen that looks like the one below:

Double click on the highlighted (red box) “Request Filtering” option. On the next screen, navigate to the “Hidden Segments” tab.

This screen will probably list some default files that are blocked. We will add the file from our site that we don’t want visitors to access. To do this, click on “Add Hidden Segment” and type in the filename you want to deny access.

And that’s all there is to it. Now when someone tries to navigate to that file they will get the error demonstrated below.

Before:

After:

This is how the rule appears in your web.config after created.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <security>
       <requestFiltering>
          <hiddenSegments>
             <add segment="readme.html" />
             <add segment="privateinfo.html" />
          </hiddenSegments>
       </requestFiltering>
    </security>
  </system.webServer>
</configuration>

I hope this helps you protect your site.

Visit Winhost to learn more about our IIS hosting solution