 <p>Have a look at this article: <a href="http://support.microsoft.com/kb/316871" rel="nofollow">HOW TO: Control Authorization Permissions in an ASP.NET Application</a></p> <p>In short you can set folder permissions like this:</p> <pre><code>&lt;configuration&gt; &lt;location path="images"&gt; &lt;system.web&gt; &lt;authorization&gt; &lt;deny users ="?" /&gt; &lt;/authorization&gt; &lt;/system.web&gt; &lt;/location&gt; &lt;/configuration&gt; </code></pre>