Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website where users upload files through a CMS.


I want to stop users on the internet being able to enter this URL into a browser and access these files directly. How can I do this?

I still need to allow IIS to read, modify and delete these files through the CMS though.

enter image description here

share|improve this question

I would recommend either saving the files to a non-web-accessible directory, or creating a random name before saving to disk.

share|improve this answer
Agreed. Save them to c:\uploads or something similar which is accessible by the application but not directly through the site. – pablo Feb 16 '11 at 8:13

How about configuring the site to accept connections only from the ip address of the CMS?

share|improve this answer
Can I do that only for a particular directory and its sub directories? Also, where do I do this in IIS from the image above? – Petras Feb 16 '11 at 4:06
You should be able to. Do it from the IPv4 and Domain Restrictions component. – joeqwerty Feb 16 '11 at 4:14
"IP address and domain Restrictions" is the setting you're looking for. It is set per directory and is inherited, by default, by all the sub-directories and files contained. – Stephane Feb 16 '11 at 8:33

Go in "request filtering" and disallow the specific URL (in the "URL" tab).

share|improve this answer

In order to make this secure, you'll have to implement it in your application in a different way.

Save the uploaded files in a folder that isn't accessible through a web request, for example in a external folder D:\WebData\MyApp\Uploads. Make sure that the Network Service account has "modify" access on this directory (for your CMS app).

Then, implement a HTTP handler in ASP.NET that checks the Session of the CMS user and allow them to only download/modify/access their own files.

share|improve this answer

go to Authorization Rules then add a Deny Rule for all users on the desired folder.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.