Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IIS 7.

Normally I would add some addresses (client IP) with deny or allow status to IIS configuration to restrict access to web pages (so from IP A.A.A.A it would be possible to get to the web page, but from B.B.B.B not). However I have a setup with SSL as well, so user can enter


In the first case she/he will be redirected to https. However, when user explicitly enters the second form no matter what IP it is, she/he gets access all the time. I am surprised that settings for restricting access apply only to HTTP, not HTTPS. Anyway, the question is:

How can I restrict access to web pages (for HTTPS), or how I can make existing restriction for HTTP to work for HTTPS as well?


The solution is stupid-simple: it is required to change the default access to "deny" (however I don't understand how/why default=allow and allowing single user makes sense and can work). With default access set to deny it works as required, however oddly I (I am allowed to access the site) cannot use HTTP, only HTTPS.

share|improve this question

You can certainly limit a folder/virtual-directory/application in IIS to HTTPS only (HTTP requests will be redirected to HTTPS).

The method depends on the IIS version.

IIS7 and later (for Vista/2008/Win7/2008R2):

  • In the containing Web Site, ensure SSL is configured (i.e. a HTTPS/SSL binding and certificate are configured).
  • Select the right location in the folder tree
  • Use SSL Settings to select "Require SSL".

IIS6 and earlier:

  • In the properties of the web site configure certificate and SSL port.
  • In the properties of applicable folder in the Directory Security Tab click on Edit and select Require Secure Channel (SSL)
share|improve this answer
Thank you, but I think there is a misunderstanding -- I have https already enabled, this is not the problem. The problem is that when I allow access ONLY from a given IP (single IP) it works for HTTP (and appropriate error page is displayed), but when I access web page directly (typing https myself) there is no error, and I get access regardless of the IP (client IP). – greenoldman Jul 31 '10 at 10:06
It works for me for both HTTP and HTTPS (but only with IPv4, can't seem to specify with IPv6, but in IIS7.5 that should be supported as well). – Richard Aug 1 '10 at 8:52
I use IPv4 too. I set "allow IP" to some odd IP (not mine) and I cannot access http but I can access https without any problem. – greenoldman Aug 3 '10 at 5:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.