title: IIS: How to disable HTTP method TRACE?
body: <p>I followed <a href="https://forums.iis.net/t/1220539.aspx" rel="nofollow noreferrer">this</a>, which led to <a href="https://docs.microsoft.com/en-us/iis/configuration/system.webServer/security/requestFiltering/verbs/" rel="nofollow noreferrer">this</a> to try to disable my website from accepting the TRACE method (verb). Basically I added the section below to <code>&lt;system.webServer&gt;</code> inside Web.config (Default Web Site and the other website):</p>
  
  <pre><code>&lt;security&gt;
     &lt;requestFiltering&gt;
         &lt;verbs applyToWebDAV="false"&gt;
            &lt;add verb="TRACE" allowed="false" /&gt;
         &lt;/verbs&gt;
     &lt;/requestFiltering&gt;
  &lt;/security&gt;
  </code></pre>
  
  <p>It didn´t work. Then I went to C:\Windows\System32\inetsrv\config\applicationHost.config and replaced all handlers' verb inside <code>&lt;handlers&gt;</code>. In a nutshell, all lines like this:</p>
  
  <pre><code>&lt;add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" /&gt;
  </code></pre>
  
  <p>Became this:</p>
  
  <pre><code>&lt;add name="StaticFile" path="*" verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" /&gt;
  </code></pre>
  
  <p>I even restarted the server but when I check the available methods, TRACE is still there:</p>
  
  <pre><code>$ curl -I -X OPTIONS https://example.com/mysite
  HTTP/1.1 200 OK
  Allow: OPTIONS, TRACE, GET, HEAD, POST
  Public: OPTIONS, TRACE, GET, HEAD, POST
  X-XSS-Protection: 1; mode=block
  Date: Thu, 07 Feb 2019 21:03:49 GMT
  Content-Length: 0
  </code></pre>
  
  <p>So, how do I get rid of it?</p>