 <p>I was struggling with same exception and <a href="http://msdn.microsoft.com/en-us/library/system.servicemodel.servicecontractattribute.protectionlevel.aspx" rel="nofollow">found this</a>:</p> <blockquote> <p>When there is no protection level explicitly specified on the contract and the underlying binding supports security (whether at the transport or message level), the effective protection level for the whole contract is ProtectionLevel.EncryptAndSign. If the binding does not support security (such as BasicHttpBinding), the effective System.Net.Security.ProtectionLevel is ProtectionLevel.None for the whole contract. The result is that depending upon the endpoint binding, clients can require different message or transport level security protection even when the contract specifies ProtectionLevel.None.</p> </blockquote> <p>So, if you don't specify ProtectionLevel in ServiceContract attribute, WCF will define ProtectionLevel based on your web.config. If you're using for example Ws2007 and BasicHttpBinding, BasicHttpBinding will fail with your exception. Then you have 3 options:</p> <ol> <li>Remove all secured bindings for your contract and leave just BasicHttpBinding.</li> <li><p>Set protection level on contract that is exposed through BasicHttpBinding as this:</p> <p>[ServiceContract(ProtectionLevel = ProtectionLevel.None)]</p></li> <li>Provide some security for BasicHttpBinding.</li> </ol>