How to get custom 404 and 403 error pages working with IIS7. Modify web.config's httpErrors?

rkin005's picture

I'm running Drupal 6 on IIS 7. I'm trying to get custom error pages working so that when users aren't logged in and they try to access restricted content they're redirected to the login page. For this I'm intending to use the logintoboggan or custom_error modules. However, regardless of how I set my default error pages in admin/settings/error-reporting I still see the standard 403 page. Is this because I need to do something in IIS web.config to tell IIS to observe those error page settings in admin/settings/error-reporting?


You need to modify web.config

chicagomom's picture

You need to modify web.config - see the example here.

here are the relevant rules:

        <rule name="Protect files and directories from prying eyes" stopProcessing="true">
          <match url=".(engine|inc|info|install|module|profile|test|po|sh|.sql|postinst.1|theme|tpl(.php)?|xtmpl|svn-base)$|^(|Entries.|Repository|Root|Tag|Template|all-wcprops|entries|format)$" />
          <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." />

    <!-- httpErrors>
      <remove statusCode="404" subStatusCode="-1" />
      <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />
    </httpErrors -->

chicagomom on Twitter and d.o.

In your example the

rkin005's picture

In your example the httpErrors tag is commented out... is that correct? doesn't that mean it's essentially not there?

yes, you have to un-comment

chicagomom's picture

yes, you have to un-comment that. thx.

chicagomom on Twitter and d.o.

Thanks. I've now got it

rkin005's picture

Thanks! I've now got it working with the following in my web.config file:

      <remove statusCode="404" subStatusCode="-1" />
      <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />
      <remove statusCode="403" subStatusCode="-1" />
      <error statusCode="403" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />

ending up at the front page

Jsan2020's picture

I am doing the same thing with IIS 7.5 on Windows Server 2008, putting this in the web.config takes me to the Front page. Is this supposed to pass the 404 to Drupal so that it is handled?

Also, are you using Custom error?

I would rather have Drupal handle 404's as any static 404 page set up for IIS to use would have to be maintained (navigation menus and such,) and I want to be able to see a report of 404's.

Do you have this in your web.config?

markjbrown's picture

Do you have this section in your web.config?

<!-- If running Windows Server 2008 R2 this can be commented out -->
    <!-- httpErrors>
      <remove statusCode="404" subStatusCode="-1" />
      <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />
    </httpErrors -->

Mark Brown
Microsoft Web Platform Team

Just redirects

jaspero's picture

I'm struggling a bit with the customerror module. I installed it, activated it, set the message and editted the web.config. The point is, when encountering a 404 or 403 it indeed redirects to the index.php but it does not do anything after that. In other words, it just redirects to the mainpage. Do you have any ideas where the problem could be?

empty page

hoobuba's picture

Chicagomom - thanks for the tips your posts are great.

I get empty page for both errors. I have commented out the httpErrors. If I leave them not commented I will get server error.

Thanks for any tips!


hoobuba's picture

Ok, I do not know if this is ideal solution, but I got it working by editing Error pages in the IIS7 Control panel. I have modified error pages by redirecting urls to the proper nodes ...

  • select server in IIS7 Control panel
  • double click error pages
  • replace your errors with

Double click the error e.g. 403 and select Execute a URL on this site


or whatever your error nodes are.

Repeat for other errors.

index.php/admin provides 403 - No Login Form

noonway's picture

Hello, all... I want to thank you all for the great resources. I was able to migrate a Drupal 6 site from Apache to IIS7 and enable clean-urls. I am also able to redirect all 404 errors back to index.php without a problem. However, and herein lies my dilemma:

In my Drupal theme I have shut off the login block because I want to use the site as a simple "www" website for most users. However, I still want to allow some remote admins to log into the Drupal installation and modify content in the CMS. Right now, they have no way to do that because when I try to go to IIS gives me a 403 error (as it should) but then does not redirect me to a login page.

When I had this set up in Apache, if I went to it would redirect me to the Garland theme where I could login and modify the site as an admin.

Any ideas on how I can get IIS to have the same redirection behavior? Is there something like that wouldn't automatically throw a 403 error?

And of course, I spend 2

noonway's picture

And of course, I spend 2 hours searching for the answer before posting and find the answer 2 minutes after posting... Here is the solution for anyone else having this problem with IIS:

If you go here:
It will ask for a login name and password without first throwing a 403.

Taken from this thread:

One trick I've used on a few

mattconnolly's picture

One trick I've used on a few sites is to only show the login block on certain pages, such as 'admin' in the Site Building -> Blocks setup.

This might conflict with your error messages, but might still be useful....

I solved this way

elgandoz's picture

I solved this (see post using LoginDestination and LoginToboggan and modifing web.config in this way:

      <remove statusCode="404" subStatusCode="-1" />
      <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" />
     <remove statusCode="403" subStatusCode="-1" />
      <error statusCode="403" prefixLanguageFilePath="" path="/index.php?q=user/login" responseMode="ExecuteURL" />

Hope it could help someone.

how much server load does the

Canadaka's picture

how much server load does the drupal error page produce, since it includes the bootsrap? Wouldn't it be better to just make a simple static html file and use that as the 404 error page?

Canadaka, you're right - if

Garrett Albright's picture

Canadaka, you're right - if you have performance in mind, you'd want to try to avoid bootstrapping Drupal as much and possible, and therefore use static HTML pages for the 403/404 pages. But as for how much load these pages produce if they're handled by Drupal, unless you have these pages doing something unusual like Search 404 does, then it's actually not that much compared to a "normal" node, an uncached view, etc.

thanks for the response, that

Canadaka's picture

thanks for the response, that makes sense.

I had custom error pages working a few days ago, but something i've changed has stopped them from working. No matter what I try the drupal error handler is loading and not my custom error pages.

There was a line in the .htaccess file directing ErrorDocument 404 to /index.php so i removed that. There are no other mentions of errors in my .htaccess file. This is my web.config file.

<?xml version="1.0" encoding="UTF-8"?>



So why are thee above not loading and instead the drupals error handling? Even if there was a line in .htaccess shouldn't the IIS error handling come first?
I've tried restarting the website and application pool, still broken.

Have you checked to be

chicagomom's picture

Have you checked to be certain you don't have another web.config file at a higher or lower level? IIS allows you to put a web.config file at the root and also at subdirs where you might have an app (for example you might have multiple if you are running multiple sites off one box).

chicagomom on Twitter and d.o.

there are none above, I do

Canadaka's picture

there are none above, I do have a few web.config's in some of the drupal sub folders like "sites\default\files" to control the cache lifetime.

<?xml version="1.0" encoding="UTF-8"?>



But going to a url like /nothere.html which isn't in a sub-folder I would think there would be no override.
THe location of my error pages doens't seem to matter, I even tried setting 404 to do a 302 redirect to and that doesn't work.

I just tried removing the .htaccess file from the root folder, which breaks all URL rewriting, but the error pages started working. So its something in the htaccess.
I tried remocing blocks of code from it to narrow down which part is stopping the error pages from working and it seems its the core drupal rewrite ruleset.

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

So I guess IIS runs the .htaccess file through ISAPI Rewrite before it runs the web.config, or it takes over at least. So I guess I just have to use .htaccess rules to redirect to the error pages rather than web.config.

But it seems that doesn't work! "Unfortunately, ISAPI_Rewrite does not have an equivalent for ErrorDocument directive.
But you can set the custom page for 500 error in IIS settings."

So I'm not sure what i'm supposed to do. I guess try to switch over to using Microsofts URL Rewriter.. but the boost rewrite rules won't import for that.

Drupal on Windows

Group organizers

Group notifications

This group offers an RSS feed. Or subscribe to these personalized, sitewide feeds: