Verbs <verbs>


The <verbs> element specifies which HTTP verbs are allowed or denied to limit the type of HTTP requests that are allowed by the Web server.

Note: When request filtering blocks an HTTP request because of a denied HTTP verb, IIS 7 will return an HTTP 404 error to the client and log the following HTTP status with a unique substatus that identifies the reason that the request was denied:

HTTP Substatus Description
404.6 Verb Denied

This substatus allows Web administrators to analyze their IIS logs and identify potential threats.


Version Notes
IIS 7.5 The <verbs> element was not modified in IIS 7.5.
IIS 7.0 The <verbs> element of the <requestFiltering> collection was introduced in IIS 7.0.
IIS 6.0 The <verbs> element replaces the IIS 6.0 UrlScan [AllowVerbs] and [DenyVerbs] features.


The default installation of IIS 7 includes the Request Filtering role service. If the Request Filtering role service is uninstalled, you can reinstall it using the following steps.

Windows Server 2008 or Windows Server 2008 R2

  1. On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
  2. In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
  3. In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
  4. On the Select Role Services page of the Add Role Services Wizard, select Request Filtering, and then click Next.
  5. On the Confirm Installation Selections page, click Install.
  6. On the Results page, click Close.

Windows Vista or Windows 7

  1. On the taskbar, click Start, and then click Control Panel.
  2. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
  3. Expand Internet Information Services, then World Wide Web Services, and then Security.
  4. Select Request Filtering, and then click OK.

How To

Note for IIS 7.0 users: Some of the steps in this section may require that you install the Microsoft Administration Pack for IIS 7.0, which includes a user interface for request filtering. To install the Microsoft Administration Pack for IIS 7.0, please see the following URL:

How to deny an HTTP verb

  1. Open Internet Information Services (IIS) Manager:
    • If you are using Windows Server 2008 or Windows Server 2008 R2:
      • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
    • If you are using Windows Vista or Windows 7:
      • On the taskbar, click Start, and then click Control Panel.
      • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  2. In the Connections pane, go to the connection, site, application, or directory for which you want to modify your request filtering settings.
  3. In the Home pane, double-click Request Filtering.
  4. In the Request Filtering pane, click the HTTP verbs tab, and then click Deny Verb... in the Actions pane.
  5. In the Deny Verb dialog box, enter the HTTP verb that you wish to block, and then click OK.

    For example, to prevent HTTP TRACE requests to your server, you would enter "TRACE" in the dialog box.



Attribute Description
allowUnlisted Optional Boolean attribute.

Specifies whether the Web server should process unlisted verbs. If you set this attribute to true, you must list all verbs you want to deny. If you set this attribute to false, you must list all verbs that you want to allow.

The default value is true.
applyToWebDAV Optional Boolean attribute.

Specifies whether these settings should also apply to WebDAV requests.

Child Elements

Element Description
add Optional element.

Adds a verb to the verbs collection.
clear Optional element.

Removes all references to verbs from the verbs collection.
remove Optional element.

Removes a reference to a verb from the verbs collection.

Configuration Sample

The following example Web.config file will configure two options: it will configure IIS to deny HTTP PUT requests, and it will configure request filtering to allow WebDAV access to all HTTP verbs.

            <verbs applyToWebDAV="false">
               <add verb="PUT" allowed="false" />

Sample Code

The following code samples will configure two options: they will configure IIS to deny HTTP PUT requests for the "Default Web Site", and they will configure request filtering to allow WebDAV access to all HTTP verbs.


appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /verbs.applyToWebDAV:"False"

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"verbs.[verb='PUT',allowed='False']"


using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
   private static void Main()
      using (ServerManager serverManager = new ServerManager())
         Configuration config = serverManager.GetWebConfiguration("Default Web Site");
         ConfigurationSection requestFilteringSection = config.GetSection("system.webServer/security/requestFiltering");

         ConfigurationElement verbsElement = requestFilteringSection.GetChildElement("verbs");
         verbsElement["applyToWebDAV"] = false;
         ConfigurationElementCollection verbsCollection = verbsElement.GetCollection();

         ConfigurationElement addElement = verbsCollection.CreateElement("add");
         addElement["verb"] = @"PUT";
         addElement["allowed"] = false;



Imports System
Imports System.Text
Imports Microsoft.Web.Administration

Module Sample

   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetWebConfiguration("Default Web Site")
      Dim requestFilteringSection As ConfigurationSection = config.GetSection("system.webServer/security/requestFiltering")

      Dim verbsElement As ConfigurationElement = requestFilteringSection.GetChildElement("verbs")
      verbsElement("applyToWebDAV") = False
      Dim verbsCollection As ConfigurationElementCollection = verbsElement.GetCollection

      Dim addElement As ConfigurationElement = verbsCollection.CreateElement("add")
      addElement("verb") = "PUT"
      addElement("allowed") = False

   End Sub

End Module


var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site";
var requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site");

var verbsElement = requestFilteringSection.ChildElements.Item("verbs");
verbsElement.Properties.Item("applyToWebDAV").Value = false;
var verbsCollection = verbsElement.Collection;

var addElement = verbsCollection.CreateNewElement("add");
addElement.Properties.Item("verb").Value = "PUT";
addElement.Properties.Item("allowed").Value = false;



Set adminManager = WScript.CreateObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site"
Set requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site")

Set verbsElement = requestFilteringSection.ChildElements.Item("verbs")
verbsElement.Properties.Item("applyToWebDAV").Value = False
Set verbsCollection = verbsElement.Collection

Set addElement = verbsCollection.CreateNewElement("add")
addElement.Properties.Item("verb").Value = "PUT"
addElement.Properties.Item("allowed").Value = False

Deprecated Elements