Question

I have a ASP.NET 4.0 web forms application (IIS 7) where I am using URL routing to allow friendly URLs. For example, instead of Blog.aspx?title=the-blog-title, I allow Blog/the-blog-title.

My question is: How do I prevent users from directly accessing Blog.aspx? I have included the following setting in my web.config:

<httpHandlers>
  <add verb="*" path="*.aspx" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>

This works, but it shows a ‘This type of page is not served’ error. Is it possible to simply display a 404 error for all .aspx page requests using IIS or web.config? (I know how to do this programatically, but I would prefer to use a config file if possible.)

Answer 1

Use URL Rewriting to change the offending addresses to those you prefer. Here’s an article explaining the difference between the two ideas.

SEO aspects of URL Rewriting

URL Rewriting does not dilute SEO; in fact, that is how you establish canonical URLs, by rewriting the URL. Search engines only see the rewritten URL, not the URL used for the request.

For example, if you have the following URLs that all point to your homepage:

• http://example.com/
• http://example.com/default.aspx
• http://www.example.com/
• http://www.example.com/default.aspx

Then, you can rewrite the URL so anyone requesting any of the above URLs will be given the URL http://www.example.com/. This URL is the only one that would be seen by search engines, regardless of how the page was initially accessed.

How Rewriting Works

When you request a URL, whether that is for example.com/blog.aspx or example.com/blog, the request is sent to the web server. There, the URL rewrite engine evaluates the URL in the request headers. If the URL matches any rewrite rules (for example, to remove the .aspx extension), then the web server issues a 301 Permanently Moved response code, with the new URL in the response header.

After receiving the response, the browser requests the new URL. Search engine bots like googlebot see the permanent redirect code and changes the index of that link to the requested URL. So, if it has indexed example.com/blog.aspx, or anyone links to it, the 301 Permanently Moved response tells the spider that the new URL is actually example.com/blog. Therefore, in the eyes of the spider, example.com/blog.aspx is example.com/blog.

This is how people move websites and pages around without losing PageRank, because the rewrite engine points the spiders to the new page, so the new page name keeps the same PageRank as the old page name.

URL Rewriting is also how sites can be accessed using, to take this site as an example, www.stackoverflow.com and have the browser actually show stackoverflow.com (without the www). The rewrite engine tells the browser (and the spider) that references to www.stackflow.com are actually called stackoverflow.com.

---

While you have already found a solution with which you are happy, I’d highly recommend spending some time looking at URL Rewriting, as it is a more elegant and professional solution than sending error messages. It’ll also allow you to redirect all non-www requests to the www url, further preventing dilution of your SEO ranking.