Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a website that can't execute any server side code (asp,, etc.).

I've tried using an application pool that has "No Managed Code" as the .NET Framework version, but classic asp code still executes.

I tried removing all ISAPI Filters but that didn't help.

Removing the ".asp" Handler Mapping worked. Should I remove all *.[ext] handlers to lock it down further?

I still need to run code on some sites, but I'd like to be able to offer vanilla web hosting on sites as needed.

share|improve this question

You can select which features of IIS are installed and available in the server; if you remove all application development features, the web server will not process any server-side code.

share|improve this answer
He says he needs to allow code on some sites but not others. This won't work in that scenario. – Chris McKeown Feb 14 '14 at 0:41
up vote 0 down vote accepted

After some more tinkering, I think I figured it out.

IIS Manager > [My Site] > Handler Mappings > Edit Feature Permissions > uncheck "Script"

This disables most of the handlers, which prevents classic asp & files from running, but still serves up html.

Not sure if this is the correct way, but it appears to work.

share|improve this answer
Darn, now I have a new problem. This setting adds web.config to the folder. I want to provide FTP access but not allow them to update the web.config file. – William Jens Feb 14 '14 at 19:04
Almost EVERY site-level or folder-level setting in (recent) IIS is stored in a web.config file; that's just the way it works. – Massimo Feb 17 '14 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.