From this article : Disable Trace/Track in IIS | Techstacks HOWTO's, I came to know that you need to install UrlScan Filter to disable TRACE/TRACK requests on IIS 7.5. However, I had trouble installing UrlScan Filter (I'm not a .NET developer) -- Microsoft UrlScan Filter v3.1 Setup Wizard fails with message IIS Metabase is required | Server Fault.

Are there other ways of disabling TRACE/TRACK requests ?


On IIS 7.0 or later, it didn't rely on UrlScan anymore. You can configure <requestFiltering> to DENY the verb TRACE. For example, in your web.config:

               <add verb="TRACE" allowed="false" />

You can find details here: https://docs.microsoft.com/en-us/iis/configuration/system.webServer/security/requestFiltering/verbs/

| improve this answer | |
  • Tried the instructions in the link above but the results are not per expectations. How do we fix this ? – anjanb Mar 6 '18 at 14:32
  • if these instructions didn't work, what would I do ? – anjanb Mar 14 '18 at 16:08
  • 1
    Then you should troubleshoot why it doesn't work. Maybe you can start with IIS log. – Chun Liu Mar 15 '18 at 8:05

If anyone is still having difficulty disabling TRACE/TRACK verbs, here are the instructions to do it via IIS Manager:

  1. Go to IIS Manager
  2. Click the website name
  3. Double click “Request Filtering” (If you don’t see Request Filtering icon, please install it)
  4. Go to “HTTP Verbs” tab
  5. Click “Deny Verb” from the Actions menu. Type “TRACE”. Click “OK”
  6. Click “Deny Verb” from the Actions menu. Type “TRACK”. Click “OK”

Please note that TRACK verb is disabled by default after IIS 7. TRACE is disabled as well except IIS 8.5:

enter image description here

For more information on this topic: How to disable HTTP TRACK and TRACE verbs in IIS?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.