Request Filtering
Request Filtering is IIS’s first line of defence. It rejects dangerous or oversized requests before they reach your app.
On this page · 5 min · Intermediate
On this page
- In simple words
- Learning objectives
- Explanation
- Code example
- Step by step
- Real-world use
- Common mistakes
- Best practices
- Remember this
- Practice exercise
- Mini quiz
- Related topics
- My notes
- Reading time
- 5 min
- Difficulty
- Intermediate
- Updated
- Oct 30, 2026
Related tutorials
Interview questions
In simple words#
Request Filtering is the metal detector at the entrance: parcels too big, banned items (file types) and suspicious-looking visitors (strange URLs) are stopped before entering the building.
- maxAllowedContentLength
- Max request body size; default 30,000,000 bytes (~28.6 MB).
- Hidden segments
- Folders that can never be served, e.g. bin, App_Data.
- 404.13
- Error when content is too large.
Learning objectives#
- Raise or lower upload limits
- Block file extensions and verbs
- Hide sensitive folders
- Read request-filtering error codes
Explanation#
Request limits: maxAllowedContentLength (body size, bytes), maxUrl (default 4096) and maxQueryString (default 2048).
File name extensions: allow or deny extensions (.config, .cs and .mdb are denied by default).
Hidden segments block whole folder names in any URL (bin, App_Code, App_Data, .git).
Each rejection has its own 404 sub-status: 404.13 too large, 404.7 extension denied, 404.8 hidden segment, 404.14 URL too long, 404.15 query string too long.
Code example: Upload site with tighter security#
<system.webServer>
<security>
<requestFiltering removeServerHeader="true" allowDoubleEscaping="false">
<requestLimits maxAllowedContentLength="104857600" maxUrl="2048" maxQueryString="1024" />
<fileExtensions allowUnlisted="true">
<add fileExtension=".bak" allowed="false" />
<add fileExtension=".log" allowed="false" />
<add fileExtension=".sql" allowed="false" />
</fileExtensions>
<hiddenSegments>
<add segment=".git" />
<add segment="logs" />
</hiddenSegments>
<verbs allowUnlisted="false">
<add verb="GET" allowed="true" />
<add verb="POST" allowed="true" />
<add verb="PUT" allowed="true" />
<add verb="DELETE" allowed="true" />
<add verb="HEAD" allowed="true" />
</verbs>
</requestFiltering>
</security>
</system.webServer>
Uploads up to 100 MB are accepted; requests for .bak/.log/.sql files, /logs or /.git return 404; TRACE and other verbs are rejected.
This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.
Step-by-step explanation#
- 104,857,600 bytes = 100 MB upload limit.
- Shorter URL/query limits reduce abuse.
- Backup and log files can never be downloaded.
- Only the listed HTTP verbs are allowed.
Real-world use case#
A deployment accidentally left a database backup in the site folder; the .bak rule kept it from being downloaded.
Common mistakes#
Raise maxAllowedContentLength — and the ASP.NET Core request size limit — together.
Allow the verbs your API uses.
Best practices#
- Set realistic upload limits
- Deny backup/log extensions
- Hide .git and log folders
- Never store secrets inside the site folder
Remember this#
Default upload limit ≈ 28.6 MB.
404.13 = too big, 404.7 = extension, 404.8 = hidden segment.
Filter before the app sees it.
Practice exercise#
Your task: Raise the upload limit to 200 MB with appcmd.
Show solution
& "$env:windir\System32\inetsrv\appcmd.exe" set config "Shop" -section:requestFiltering /requestLimits.maxAllowedContentLength:209715200
Mini quiz#
Which status code means the request body exceeded maxAllowedContentLength?
Want more? Practise all IIS MCQs · IIS interview questions
My notes#
Saved in this browser.