

The web.config file may provide additional IIS configuration settings that control active IIS modules. The transformation doesn't modify IIS configuration settings in the file. If a web.config file is present in the project, the file is transformed with the correct processPath and arguments to configure the ASP.NET Core Module and moved to published output. If a web.config file isn't present in the project, the file is created with the correct processPath and arguments to configure the ASP.NET Core Module and moved to published output. Never remove the web.config file from a production deployment. The web.config file must be present in the deployment at all times, correctly named, and able to configure the site for normal start up. If the web.config file is missing, incorrectly named, or unable to configure the site for normal startup, IIS may serve sensitive files publicly. When the web.config file is present and the site starts normally, IIS doesn't serve these sensitive files if they're requested. Sensitive files exist on the app's physical path, such as is the assembly name. The web.config file is required at the root of the app to enable the publishing of multiple apps using Web Deploy. This is the same location as the website physical path provided to IIS.

In order to set up the ASP.NET Core Module correctly, the web.config file must be present at the content root path (typically the app base path) of the deployed app.

The web.config is a file that is read by IIS and the ASP.NET Core Module to configure an app hosted with IIS.
