Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several files on my ASP.NET site that are for use solely by the application. Currently, they can be viewed in a browser by just using the URL. Is there a way to prevent this without actually moving the file or do I need to move the files to a different directory, such as _private?

share|improve this question
Can you tell us what kind of files they are? – squillman May 29 '09 at 16:44
Certainly, currently just XML/text files. – Jeff Yates May 29 '09 at 16:46
I realise this may be a very very noob question for ASP stuff, but I am completely new to the admin side, which I need to know at this stage of the project. I appreciate the help. – Jeff Yates May 29 '09 at 16:47
What version of IIS are you running? – notandy Jun 1 '09 at 18:05
up vote 2 down vote accepted

If you are able to install software on the server, you can install Microsofts URLScan for IIS to restrict what files IIS will serve. This will be for the whole server however, rather than just the application.

You should also be able to do so on a site basis, using the web.config file, the details are here, they are for IIS 5 and .net 1.1 but the principal is the same.

share|improve this answer
Thanks. I'll try this out. – Jeff Yates May 29 '09 at 17:03
The web.config file change was sufficient for the particular problem - thanks! (I'll upvote when I have better rep) – Jeff Yates Jun 2 '09 at 18:13

Use the IIS Manager to block them individually by navigating to the file, right clicking on it, and removing the check from the read checkbox.


Use IIS manager to create a rule for a file type (see this web page:

share|improve this answer

Configuration and data files that are for internal use only should be placed in the App_Data folder:

The App_Data Folder

To improve the security of the data used by your ASP.NET application, a new subfolder named App_Data has been added for ASP.NET applications. Files stored in the App_Data folder are not returned in response to direct HTTP requests, which makes the App_Data folder the recommended location for data stored with your application, including .mdf (SQL Server Express Edition), .mdb (Microsoft Access), or XML files. Note that when using the App_Data folder to store your application data, the identity of your application has read and write permissions to the App_Data folder.

What's new in ASP.NET Data Access

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.