Removing Unused HTTP Handlers for Better Performance & Security

Question

Where can I get a list of what all of the default IIS HTTP handlers do? I need documentation!! I have read a few blogs which recommend removing dozens of unused HTTP handlers fo

Answer 1

Answer to this:

Where can I get a list of that all of the default IIS HTTP handlers do?

Open IIS, CMD-->inetmgr, then click handler mappings, see below screenshot.

Click that, it will show you all default enabled HTTP handlers for that web server.

Note: When you select a virtual directory and then do this process, i.e. click handler mappings, and remove one of mapping, it will add that line in web.config.

E.g. I have removed aspq-ISAPI-4.0_64bit, so it has changed web.config for that virtual directory, i.e. it has added following line to web.config.

under system.webServer\handlers.

Update : This handlers are invoked when particular file type request come, until then it sits idle. So there won't be any performance issue for these handlers.

Example, that you have removing handler for *.axd will improve security, my answer to this, some DLL might need those files for rendering js and css, and if you remove that, it will not work. E.g. - HTTP Handler cannot find axd file in nested web application folder: Telerik RadScriptManager cannot find WebResource.axd in ~/admin/ folder