I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?


1 Answer 1


This question seems more to fit in stack overflow.

However you can remove those files by adding following to all my web.config files

        <remove path="WebResource.axd" verb="GET"/>
        <remove path="WebResource.axd" verb="POST"/>
        <remove path="ScriptResource.axd" verb="GET"/>
        <remove path="ScriptResource.axd" verb="POST"/>

Now when you try to get these pages you might be prompted to login or given 404 error.

Also remove them from in

         <remove name="ScriptResourceIntegrated-4.0"/>

<location path="WebResource.axd">
 <deny users="*"/>
  • <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location> //I can prevent public access to WebResource.axd file by using the above line of code in webconfig file. //But i am unable to do the same for ScriptResource.axd
    – Vinay D
    Commented Apr 4, 2019 at 10:24
  • please check this. stackoverflow.com/questions/28856991/…. Also try URL rewriting.
    – Rohith K D
    Commented Apr 4, 2019 at 10:29
  • <system.webServer> <handlers> <remove name="ScriptResourceIntegrated-4.0"/> </handlers> </system.webServer> above lines worked for me to prevent public access to ScriptResource.axd
    – Vinay D
    Commented Apr 4, 2019 at 10:42
  • Thanks. I have updated the answer.
    – Rohith K D
    Commented Apr 4, 2019 at 10:48
  • Add this as well <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location>
    – Vinay D
    Commented Apr 4, 2019 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .