---
title: Restricting access to directories
related:
  - https://docs.kentico.com/13/deploying-websites/exporting-and-importing-sites/export-import-package-directory-browsing.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

We recommend that you only allow users to access the file system directories that they actually need. This means that you should forbid access to directories for all users that do not need them.

You can configure directory restrictions in the project's web.config file. The following example **forbids access** to the _CMSSiteUtils_ directory according to the configuration of the **** element. See the [Security Authorization](http://www.iis.net/configreference/system.webserver/security/authorization) article for more information about the available options.

```xml

<location path="CMSSiteUtils">
    <system.webServer>
        <security>
            <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Allow" users="" roles=""/>
            </authorization>
        </security>
    </system.webServer>
</location>

```

The _CMSSiteUtils_ directory of the Xperience project contains export files and is therefore the most vulnerable and must be protected properly.

## Disabling directory browsing

Another important security precaution is to disallow listing of files in directories. This can be set in the IIS (and should be already set as default configuration). It is recommended to disable directory listing for the whole website, although you can also disable this feature only for individual directories. In such case, do not forget to disable directory browsing for the CMSSiteUtils directory.

1. Open the IIS Manager.
2. Select the project for which you want to disable the listing of files.
3. Double-click the **Directory Browsing** icon in the IIS section.

   ![Select the project and open Directory Browsing](https://docs.kentico.com/docsassets/13/restricting-access-to-directories/image2013-8-9+1.png "Select the project and open Directory Browsing")
4. Click **Disable**.

   ![Disable directory browsing](https://docs.kentico.com/docsassets/13/restricting-access-to-directories/image2013-8-9.png "Disable directory browsing")

Now it is not possible to list files in directories on your website.

## Disabling unnecessary execution of scripts

You should forbid the execution of scripts where it is not required. This mainly applies to directories with multimedia or directories where you allow uploading of images. This can be set in the IIS, see [Edit Feature Permissions for the Handler Mappings Feature (IIS 7)](http://technet.microsoft.com/en-us/library/cc725855%28v=ws.10%29.aspx) for instructions.

## Keeping the web servers clean

The server where your web presentation is located should not contain any other unnecessary data. It is not wise to store any sensitive information there (e.g., database exports).

## CDN and external storage

In Xperience, it is possible to store data in Azure blob storage and Amazon S3 storage. Both can be configured to allow public access so that anyone can download files present in Xperience.

The thing is that, to enable distribution of data over CDN, you need to **enable public access** to these data. This can pose a security risk, as you do not usually want everyone to be able to download all files from these storages. Therefore, you can set only certain containers (Azure blob) and buckets (Amazon S3) to be publicly available.

You can find more information in [Configuring file system providers](https://docs.kentico.com/13/custom-development/working-with-physical-files-using-the-api/configuring-file-system-providers.md).