---
title: "Allow or deny users access to web resources"
slug: "allow-or-deny-users-access-to-web-resources"
abstract: "How to deny or allow users access to resources in the Sitecore web root folder."
---
# Allow or deny users access to web resources

You can set up access privileges for web resources with the `location` tag in the `Web.config` file. This example configuration denies access to the `/sitecore` path for all users except `admin` and `webmaster`:

```xml
<authorization>
  <allow users="admin, webmaster" />
  <deny users="*" />
</authorization>

```

When multiple `allow` and `deny` rules are defined, Sitecore evaluates them in the order they appear, following standard [ASP.NET Core](https://dotnet.microsoft.com/en-us/apps/aspnet) authorization behavior. More specific rules should be defined before more general ones. In particular, `allow` rules are evaluated before `deny` rules, and wildcard rules such as `deny="*"` apply only after earlier allow rules have been processed. This means that an explicit allow rule can grant access even when a later deny rule uses a wildcard.

Read more on the `deny` and `allow` tags in Microsoft's documentation on [How To Restrict Specific Users from Gaining Access to Specified Web Resources](https://support.microsoft.com/en-gb/help/815151/how-to-restrict-specific-users-from-gaining-access-to-specified-web-re).

You can also configure the `Web.config` file to use Windows ASP.NET groups and users. This is specified in Microsoft's documentation on [How to implement Windows authentication and authorization in ASP.NET](https://support.microsoft.com/en-ie/help/323176/how-to-implement-windows-authentication-and-authorization-in-asp-net).

> [!note]
> Only Core roles use the `location` tag by default, and each Core role is configured differently. We recommend that you audit your `location` tags as part of your security review process.