<system.webServer>

<security>

<requestFiltering>

<verbs allowUnlisted="true">

<add verb="OPTIONS" allowed="false"/>

<add verb="TRACE" allowed="false"/>

</verbs>

</requestFiltering>

</security>

</system.webServer>

<system.webServer>

<httpProtocol>

<customHeaders>

<add name="X-Frame-Options" value="SAMEORIGIN" />

<add name="X-XSS-Protection" value="1; mode=block" />

<add name="X-Content-Type-Options" value="nosniff" />

<add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />

<remove name="X-Powered-By" />

<add name="Cache-Control" value="no-cache, no-store" />

<add name="Pragma" value="no-cache" />

</customHeaders>

</httpProtocol>

</system.webServer>

<system.webServer>

<rewrite>

<outboundRules>

<rule name="replace server header" patternSyntax="Wildcard">

<matchserver Variable="RESPONSE_SERVER" pattern="*"/>

<action type="Rewrite" value=""/>

</rule>

</outboundRules>

</rewrite>

</system.webServer>

<system.webServer>

<handlers>

<add name="StopDirectoryBrowsing" path="*." resourceType="Directory"verb="*"

preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />

</handlers>

</system.webServer>

或

<system.webServer>

<httpErrorserror Mode="Custom">

<removestatus Code="403" />

<errorstatus Code="403" path="ErrorPage.html" responseMode="ExecuteURL" />

</httpErrors>

</system.webServer>

<system.web>

<httpRuntimeenableVersionHeader="false">

</system.web>

<system.web>

<machineKeyvalidation="AES"/>

</system.web>