Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to serve up a custom "Sorry not found" page from a direct access request to a WCF Service (.svc file) on a server running IIS 6.0, and .NET 3.5 SP1.

I have a requirement that my service in a Production environment is not discoverable. The requirement states that WSDL publishing should be off, and the request also states that when directly accessing the MyService.svc file via a HTTP Get Request that a "Sorry Not found" page is displayed instead.

I have no problem disabling the metadata in the config file.

<serviceMetadata httpGetEnabled="false" />

But I can't figure out a way to not show the default .svc page.

This is a Windows© Communication Foundation service.

Metadata publishing for this service is currently disabled.

If you have access to the service, you can enable metadata publishing by completing the following steps to modify your web or application configuration file: ...

Also posted at Stackoverflow.

share|improve this question
You can hide the .svc extension: – Tuomas Hietanen Jul 29 '10 at 12:37

Can't you just restrict access using your clientaccesspolicy.xml or crossdomainpolicy.xml files?

You could also just host the service on a different port, if you're worried that someone will wander onto http://yoursite/service.svc

Example of a crossdomainpolicy.xml from

  <site-control permitted-cross-domain-policies="all" /> 
  <allow-access-from domain="*" secure="false" /> 
  <allow-http-request-headers-from domain="*" headers="*" secure="false" /> 
share|improve this answer
No, it is a valid service and needs to work for HTTP Post, just not HTTP Get on the direct .svc page. Yes, it is a strange request, but Security Teams can be strange themselves. I personally don't think it is possible. – degnome Oct 27 '09 at 21:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.