Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ASP.NET application deployed to an IIS 7 server. Because this is a beta site, I would like to prevent users from browsing to this site by securing the entire site with a username and password that is different from the username and password used to log into my web application.

Is it possible to do this without changing my web app and my web.config? Can I make this happen via IIS 7?

share|improve this question

You'll want to turn off anonymous authentication and turn on either windows auth or basic auth for the website.

share|improve this answer

You can't do it without modifying the web.config, but the modification is simple, and should be pretty easy to pull when you send the app to production.

Check this out, it should do exactly what you want.

share|improve this answer
When I try this, I get redirected to the login page. Isn't there a way to get the old windows-style user/password prompt? – JMP Jun 29 '10 at 18:47
This answer isn't exactly true. You can use windows authentication or basic authentication and turn off anonymous. Modifying the web.config assumes that you're managing the users in and that you're handling anonymous authentication – GregD Nov 12 '10 at 17:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.