<FilesMatch "\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$">
  Order allow,deny
</FilesMatch>

نمونه کد web.config:

       <security>
            <requestFiltering>
                <denyUrlSequences>
                    <add sequence="engine" />
                    <add sequence="inc" />
                    <add sequence="info" />
                    <add sequence="install" />
                    <add sequence="module" />
                    <add sequence="profile" />
                    <add sequence="po" />
                    <add sequence="sh" />
                    <add sequence="theme" />
                    <add sequence="tpl(\.php" />
                    <add sequence="Root" />
                    <add sequence="Tag" />
                    <add sequence="Template" />
                    <add sequence="Repository" />
                    <add sequence="code-style" />
                </denyUrlSequences>
                <fileExtensions>
                    <add fileExtension=".sql" allowed="false" />
                    <add fileExtension=".pl" allowed="false" />
                </fileExtensions>
            </requestFiltering>
        </security>

        <rule name="Protect files and directories from prying eyes" stopProcessing="true">
                <match url="\.(engine|inc|info|install|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl|svn-base)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format)$" />
                <action type="CustomResponse" statusCode="403" subStatusCode="0"
                    statusReason="Forbidden"
                    statusDescription="Access is forbidden." />
        </rule>

# Set the default handler.
DirectoryIndex index.php

       <defaultDocument>
            <files>
                <remove value="index.php" />
                <add value="index.php" />
            </files>
        </defaultDocument>

  RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
  RewriteRule ^(.*)$ http://www.example.com/$1 [L,R=301]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

<rewrite>
  <rules>
    <rule name="Imported Rule 1" stopProcessing="true">
      <match url="^(.*)$" ignoreCase="false" />
      <conditions>
        <add input="{HTTP_HOST}" pattern="^example\.com$" />
      </conditions>
      <action type="Redirect" redirectType="Permanent" url="http://www.example.com/{R:1}" />
    </rule>
    <rule name="Imported Rule 2" stopProcessing="true">
      <match url="^(.*)$" ignoreCase="false" />
      <conditions>
        <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
        <add input="{URL}" pattern="^/favicon.ico$" ignoreCase="false" negate="true" />
      </conditions>
      <action type="Rewrite" url="index.php?q={R:1}" appendQueryString="true" />
    </rule>
  </rules>
</rewrite>

# Make Application handle any 404 errors.
ErrorDocument 404 /index.php

        <!-- HTTP Errors section should only be enabled if the "Error Pages"
        feature has been delegated as "Read/Write" at the Web Server level.
           <httpErrors>
               <remove statusCode="404" subStatusCode="-1" />
               <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />
           </httpErrors>
        -->

# Requires mod_expires to be enabled.
<IfModule mod_expires.c>
  # Enable expirations.
  ExpiresActive On
  # Cache all files for 2 weeks after access (A).
  ExpiresDefault A1209600
  # Do not cache dynamically generated pages.
  ExpiresByType text/html A1
</IfModule>

        <caching>
            <profiles>
                <add extension=".php" policy="DisableCache" kernelCachePolicy="DisableCache" />
                <add extension=".html" policy="CacheForTimePeriod" kernelCachePolicy="CacheForTimePeriod" duration="14:00:00:00" />
            </profiles>
        </caching>