I've got FBA enabled. Created custom login page, which uses two factor authentication. It is all working fine, same as /_forms/default.aspx.

However, I'd not like users to use /_forms/default.aspx as a back-door and skip additional security check at login.

What is the the best approach for this scenario?

  • I can do that as modifying web.config for _forms: <deny users="*" /> But it seems like a hack.
    – Milen
    Nov 5, 2013 at 10:29

1 Answer 1


You can override the login page on the web application settings in Central Administration. You would need to create a login page to replace it with. There are a number of examples on the web, here is one you could start with: http://sivarajan.me/post/SharePoint-2013-Enabling-Custom-Login-Page-and-Mixed-Contents-Part-2


To answer your revised question, you can redirect the page at the IIS level. The URL Rewrite module for IIS could handle this for you: http://www.iis.net/downloads/microsoft/url-rewrite


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.