web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
   <system.webServer>
       <rewrite>
           <rules>
               <rule name="Block Scripts" stopProcessing="true">
                   <match url="([^\\/]+)\.(php|php3|php4|php5|phtml|inc)$" />
                   <conditions trackAllCaptures="true">
                       <add input="{REQUEST_FILENAME}" pattern="\b(main|rpc|tiny_mce_gzip)\.php$" negate="true" />
                   </conditions>
                   <action type="AbortRequest" />
               </rule>
               <rule name="Block Version" stopProcessing="true">
                   <match url="\bsilverstripe_version$" />
                   <action type="AbortRequest" />
               </rule>
           </rules>
       </rewrite>
   </system.webServer>
</configuration>