Web.config

iis config file (more info: http://go.microsoft.com/fwlink/?LinkId=169433)

enable directory listing

<configuration>
 <system.webServer>
   <directoryBrowse enabled="true" showFlags="Date,Time,Extension,Size" />
 </system.webServer>
</configuration>

rewrite http -> https

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Redirect to https">
          <match url="(.*)"/>
          <conditions>
            <add input="{HTTPS}" pattern="Off"/>
            <add input="{REQUEST_METHOD}" pattern="^get$|^head$" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"/>
        </rule>
        <rule name="Redirect to www">
          <match url=".*" />
          <conditions logicalGrouping="MatchAny">
            <add input="{HTTP_HOST}" pattern="^(www\.)(.*)$" negate="true" />
          </conditions>
          <action type="Redirect" url="http://www.{HTTP_HOST}/{R:0}" redirectType="Permanent"/>
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

add security headers

https://securityheaders.io/

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
     <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="Strict-Transport-Security" value="max-age=31536000" />
        <add name="Public-Key-Pins" value="pin-sha256=&quot;getyourownvalue=&quot;; pin-sha256=&quot;getyourownvalue=&quot;; max-age=31536000" />
        <add name="Content-Security-Policy" value="default-src https: data: 'unsafe-inline' 'unsafe-eval'" />
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <add name="X-Xss-Protection" value="1; mode=block" />
        <add name="X-Content-Type-Options" value="nosniff" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>