Network Management

How to disable HTTP methods in IIS

This article explains how to disable the HTTP such as TRACE, TRACK, PUT, and DELETE methods in IIS. These methods can be flagged as unsafe by vulnerability assessments as dangerous HTTP Methods

First published date

4/29/2020 11:28 AM

Last published date

7/12/2023 3:48 AM

Overview

These methods can be used to leverage other attacks on a system and are, for the most part, considered old (remediated by modern browsers). By default, these methods are typically disabled.

IIS Versions - is TRACK / TRACE enabled by default
IIS Version	TRACE	TRACK
7	Disabled	Disabled
8.5	Enabled	Disabled
10	Disabled	Disabled

IIS allows you to filter HTTP commands and deny any TRACE or TRACK methods. This article explains how to create these filters.

Product section

Network Performance Monitor

Cause

Dangerous HTTP Methods have been flagged in the vulnerability scan
HTTP TRACK, TRACE, PUT and DELETE can be used to leverage other attacks.

Resolution

How to deny an HTTP verb:

Go to IIS Manager
Select the Orion website
Select Request Filtering
Select HTTP Verbs
Select Deny Verbs...
Enter TRACE and click OK

Do this for TRACK, PUT and DELETE

Save the changes

You can also follow the Microsoft steps here
(© 2020 Microsoft, available at https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/, obtained on 04, 29 day, 2020)

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.