<add verb="*" path="*.aspx" type="System.Web.UI.PageHandlerFactory, System.Web" />
<add verb="*" path="*.asmx" validate="false"
type="System.Web.Services.Protocols.WebServiceHandlerFactory, System.Web.Services" />
+ <add verb="*" path="*.ashx" type="System.Web.UI.SimpleHandlerFactory, System.Web" />
<add verb="*" path="*.asax" type="System.Web.HttpForbiddenHandler, System.Web" />
<add verb="*" path="*.ascx" type="System.Web.HttpForbiddenHandler, System.Web" />
<add verb="*" path="*.config" type="System.Web.HttpForbiddenHandler, System.Web" />