HTTP Error 403.14 - Directory Listing Denied

What’s actually happening

You hit a folder URL — the site root, or something like /reports/ — and get 403.14 instead of a page. IIS resolved the path to a real directory but there was nothing to render: no index.html, no default.aspx, and directory browsing is disabled (the secure default). For an ASP.NET Core or other framework app this almost always means the app isn't actually running and IIS is treating the deploy folder as plain static content.

Common causes

• No default document exists in the folder, or the file that should be the default (index.html, default.aspx) is named differently or sitting one directory deeper.
• Directory Browsing is disabled in IIS — correct for production, but it surfaces this error when there's no default document to fall back to.
• The ASP.NET Core Module / handler never engaged, so IIS fell back to the StaticFile handler and found only a folder. Usually a broken or missing web.config.
• The application's physical path points at the wrong folder (e.g. the solution root instead of the publish output), so the expected entry point isn't where IIS is looking.
• URL Rewrite rules that should route requests into the app aren't installed or didn't load.

How to fix it

1. Confirm the default document is present and registeredCheck the folder actually contains your entry file. In IIS Manager > Default Document, make sure the right name is listed (index.html, default.aspx, etc.). For static sites, dropping a correctly named index.html in the folder is the whole fix.
2. Check the app is running, not being served as static filesFor ASP.NET Core, a 403.14 at the root usually means ANCM didn't take over. Verify web.config has the aspNetCore handler section and that the ASP.NET Core Hosting Bundle is installed. If the module is missing you'll often also see 500.19 — fix that first.
3. Point the site at the correct physical pathIn IIS Manager > Basic Settings, confirm the Physical Path is the publish output folder (the one containing your DLL and web.config), not the source tree. A wrong path is a common cause after a manual copy deploy.
4. Only enable directory browsing if you truly want a file listingIn IIS Manager > Directory Browsing > Enable, or set <directoryBrowse enabled="true" /> under <system.webServer>. Do this for an intentional file-share directory, never as a blanket fix for a web app — it exposes your file structure.