How to make IIS7 stop serving a folder?

Question

I know that by defualt IIS won't server App_Data or bin folders content to the public.
How to set one more folder to don't server to public?

Answer 1

Remove IIS_IUSR permissions from that folder.

I think its generically under the "Internet Guest Account"

Answer 2

The proper way to do that is using this:

<configuration>
   <system.webServer>
       <security>
          <requestFiltering>
               <hiddenSegments>
                   <add segment="My_Directory" />
               </hiddenSegments>
           </requestFiltering>
       </security>
   </system.webServer>
</configuration>

This allows you to still access files located there from the IUSR account, but prevents actual requests for files there from being filled directly.

Note that this will block files in that directory, and any subdirectories, no matter where that directory occurs - even if it, itself, is a sub-directory of something else.

Answer 3

I found it how to do this: http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/hiddenSegments