If you set the SPList.Hidden property to true, the list isn't shown in the Quick Launch, All Site Content, Lookup lists, etc. However, it is still possible to navigate to the list by typing in the list's URL, or by using an old bookmark.

So how do you actually hide a list, so that it won't display under any circumstances?

  • 2
    SPList.BreakRoleInheritance(false) ? Jan 26, 2012 at 15:00
  • @VedranRasol: Not a bad solution, but I'd rather avoid stripping all the permissions if possible.
    – Stu Pegg
    Jan 26, 2012 at 15:04
  • I don't understand the point of using a list if no one is supposed to be able to see it. Why not just create a database / table? Jan 26, 2012 at 17:02
  • @tylerrrr07: The data needs to be accessed programmatically by web parts, but not directly through the UI. Also, I should mention that this is for a 3rd party solution (where we're the 3rd party), so requiring direct SQL Server access is generally considered a faux-pas.
    – Stu Pegg
    Jan 27, 2012 at 8:40

5 Answers 5


I ran into the same requirement in a recent project, basically preventing access to any list view or form of a particular (hidden) list via the Web browser.

SharePoint designer isn't allowed on Web Application level and Web services (including client object model) is blocked by a custom HTTP handler, so the concerns mentioned in other answers didn't apply to this project.

Removing permissions was not an option because lookup fields of the list are used on other lists and should work for anybody, but accessing the list itself shouldn't be possible.

Instead of the tedious task of messing with URL-rewriter rules on the IIS server or a custom HTTP handler, which has several disadvantages as described later, the solution was to develop a custom SharePoint DelegateControl as described here


The DelegateControl contains code to check for a particular SharePoint group membership. If the current user isn't a member the following code blocks access to the list view & forms ASPX pages (note that the code has been simplified and might need more polishing):

string currentUrl = Request.Url.ToString().ToLower();
SPWeb currentWeb = SPControl.GetContextWeb(Context);
SPList currentList = SPContext.Current.List;

if (!currentUrl.Contains("/_layouts/") && (currentList != null && currentList.Title == "Your List Name"))
    Response.StatusCode = 403;
    Response.Status = "403 - Forbidden";
    Response.StatusDescription = "Access is denied";
    string accessDeniedPage = SPUtility.AccessDeniedPage;
    string redirectUrl = "/_layouts/" + accessDeniedPage + "?Source=" + currentUrl;
    Response.Redirect(SPUrlUtility.CombineUrl(currentWeb.Url, redirectUrl), true);

Unlike a custom HTTP handler the custom SharePoint DelegateControl will only fire its code when an ASPX page is hit which IMHO is a big advantage because the HTTP handler fires on every single request (even a JS/CSS/GIF etc. file) which puts additional load on the SharePoint Web frontend, plus the deployment of a HTTP handler is cumbersome because it has to be added to each web.config (including each extended Web Application) either manually or by writing a proper custom feature event receiver handling all the web.config modification heavy lifting. Because of those reasons I take HTTP handlers only as last resort ;-)

The above approach is working just fine even on a high volume Web site for more than a year now.

  • This is an excellent suggestion.
    – Stu Pegg
    Jan 27, 2012 at 8:46
  • 2
    I've created a normal WebControl derivative, which I've inserted directly into the custom master page. Works beautifully, thanks.
    – Stu Pegg
    Jan 27, 2012 at 11:27

You can access all sorts of things in SharePoint by typing in a url or by merely changing the querystring. If the list must be hidden always, then change security on the list so that only those with proper permissions can see it.

If you really are set on this, you can also implement some form of URL Rewriter on the IIS server hosting SharePoint and block requests for that list, though that can be a bit annoying to maintain across a farm.


Hmmm... couple of ideas come to mind, although neither is particularly awesome.

1) Create a custom HTTP handler that detects if a user is browsing to one of the list url's and redirect the user

2) Link a javascript file in your master page that does the same thing (checks the url to see if it contains /Lists/YourList) and redirect the user somewhere else.

There may be a more elegant approach, but I'm still drinking my first cup of coffee...

The problem is, that the list EXISTS.. so unless you set the permissions where NO ONE can get to it, a user that knows the url can get to it.

good luck, Mark


You can't. You can however remove all permissions so that no one besides SiteCollection administrator have access to it.


It should be pointed out that, without touching the permissions, just because it is hidden or redirected in the UI does not mean it is not accessible through other means.

SharePoint designer, web services, object model, etc. will still see it. It's the old 'security through obscurity' discussion.

If hiding is all you want, SPList.Hidden and Mark's 2nd option will do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.