How to disable the TRACE HTTP method in IIS

Products

• Server Management Suite

Issue/Introduction

Disabling the TRACE method is a security best practice because TRACE can be exploited by attackers to gather information about a web server.

Environment

n/a

Cause

n/a

Resolution

1. Open IIS Manager

• Press Windows + R to open the Run dialog.
• Type inetmgr and press Enter to open IIS Manager.

2. Select the Site

• In the left pane (Connections), expand the server node and then expand the "Sites" node.
• Select the site where you want to disable the TRACE method.

3. Go to the HTTP Request Filtering Feature

• In the middle pane (Features View), double-click on Request Filtering under the "IIS" section.

4. Block the TRACE Method

• In the "Request Filtering" feature, click on the "HTTP Verbs" tab at the top.
• Click on "Deny Verb" on the right-hand side.
• In the dialog that appears, enter TRACE in the "Verb" field.
• Click OK to apply the changes.

5. Restart the IIS Site (Optional but Recommended)

• You may want to restart the site to ensure the settings are applied. To do this:
  • In IIS Manager, right-click on the site and select "Restart".