Learn More





Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Pro Tip : Use IIS URL Rewrite To Prevent Login.aspx AccessPro Tip : Use IIS URL Rewrite To Prevent Login.aspx Access
New Post
4/12/2015 10:58 AM

Solved an interesting DNN challenge this morning and thought I'd share in case anyone else runs up against the same issue and finds this useful.

We have a number of public only no registration websites and have noticed in the event logs that we were getting a lot of failed login attempts despite the fact that the site settings user registration is set to none and no login link appears anywhere on the site.

Which means someone or something is hitting login.aspx or using the ?ctl=login query string directive to access the login page.

You'd think the solve for this would be to create a login page without a user login module on it and set that as the site's login page -- but DNN, for some good reasons, does not permit setting a page without a login module on it.

Here's a solve if you host your own server...

Create a custom login page with the login module with a hard to guess URL (something like dnnlogin343824093 for example.) Just be sure not to name it with anything starting with the string "login" -- the reason why will be evident shortly. Then set the page to not appear in the menu and also deselecting the index checkbox in page settings, advanced settings, other settings so the page will not appear in the site map and/or be indexed by search engines. Do not set this page to the site login page leave the default so that DNN will use login.aspx.

Finally install Microsoft's excellent url rewrite 2.0 on the server [], access the site via IIS manager and create a url rewrite rule to 301 redirect login* (wildcard) to any url you'd like. Since the site is set to use the default login page this will also catch the ?ctl=login requests when they are redirected.


Best regards,


Dave Abad







New Post
4/18/2015 11:42 AM
thanks for the tip. FYI you can use the built in filtering capability as well if you wish to block access (see which shows how to do so for the register page)

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
New Post
4/13/2016 2:21 AM
Thanks David for the tip, to add to your post, I created a rewrite rule in the URL Rewrite module in IIS 8 and it created a entry in the web.config file, alternatively one can insert the below entry in the web.config file:
<rule name="Block Login" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*login*" negate="false" />
                        <add input="{URL}" pattern="*login*" />
                    <action type="AbortRequest" />



HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...Pro Tip : Use IIS URL Rewrite To Prevent Login.aspx AccessPro Tip : Use IIS URL Rewrite To Prevent Login.aspx Access

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
Try Evoq
For Free
Start Free Trial
a Demo
See Evoq Live
Need More Information?