Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
IIS request filtering rejects unwanted HTTP methods and request patterns before they reach application code.
Prerequisites
- Administrative access to the affected servers.
- A verified backup and approved maintenance window.
- A pilot system for testing before production rollout.
Step-by-step procedure
- Back up IIS configuration.
- Review application methods and upload requirements.
- Block one unnecessary method in the site scope.
- Test both valid and rejected requests.
Commands
Import-Module WebAdministration
Add-WebConfigurationProperty -PSPath "IIS:\" -Filter "system.webServer/security/requestFiltering/verbs" -Name "." -Value @{verb="TRACE";allowed="false"}
Get-WebConfiguration -Filter "system.webServer/security/requestFiltering/verbs"Verification
TRACE is rejected while required application methods continue to work.
Rollback
Remove the exact filtering entry or restore the IIS configuration backup.
Security and operations
- Use least privilege and document all production changes.
- Replace example addresses and names with approved values.
- Review relevant Windows event logs after implementation.
Related resources
Canadian Windows VPS and RDS hosting is available from networkmanager.info. Also review the official Microsoft Windows Server documentation.
