I have an ASP.NET application deployed to an IIS 7 server. Because this is a beta site, I would like to prevent users from browsing to this site by securing the entire site with a username and password that is different from the username and password used to log into my web application.

Is it possible to do this without changing my web app and my web.config? Can I make this happen via IIS 7?


You'll want to turn off anonymous authentication and turn on either windows auth or basic auth for the website.


You can't do it without modifying the web.config, but the modification is simple, and should be pretty easy to pull when you send the app to production.

Check this out, it should do exactly what you want.

  • When I try this, I get redirected to the login page. Isn't there a way to get the old windows-style user/password prompt? – JMP Jun 29 '10 at 18:47
  • This answer isn't exactly true. You can use windows authentication or basic authentication and turn off anonymous. Modifying the web.config assumes that you're managing the users in asp.net and that you're handling anonymous authentication – GregD Nov 12 '10 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.