Controlling Access to Specific Files Generally, setting file access permissions by directory is the cleanest and easiest approach. However, you also have the option of restricting specific files by adding “location” tag to your web.config file.
The “location” tag sit outside the main tag and are nested directly in the base <configuration> tag.