Block direct access to HTML pages

Question

I have one website created in IIS and the root web-share has some sub-folders for stroring html files. However, user is able to access the html files if they know the file Path for example : www.test.com\html\Page1.html

Is there any way to disable direct access for this ?

Please note that this application is hosted on IIS 7.5 and is .net application

Answer 1

If you really don't want end users to access them, having them under the wwwroot folder is a risk.

Move the whole structure of folder and files that you want to "hide" out of the root of your website.

Answer 2

You might be able to use the location tag in the web config to restrict access to certain users or roles.

https://support.microsoft.com/en-gb/help/316871/how-to-control-authorization-permissions-in-an-asp.net-application