web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <!-- Don't show directory listings for URLs which map to a directory. -->
    <directoryBrowse enabled="false" />
    <rewrite>
      <rules>
        <rule name="Force simple error message for requests for non-existent favicon.ico" stopProcessing="true">
          <match url="favicon\.ico" />
          <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
          </conditions>
          <action type="CustomResponse" statusCode="404" subStatusCode="1" statusReason="File Not Found" statusDescription="The requested file favicon.ico was not found" />
        </rule>
        <rule name="hidden to vendor" stopProcessing="true">
        <match url="^vendor/" />
          <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
          </conditions>
          <action type="CustomResponse" statusCode="403" subStatusCode="1" statusReason="Access Forbidden" />
        </rule>
        <rule name="hidden to node_modules" stopProcessing="true">
        <match url="^node_modules/" />
          <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
          </conditions>
          <action type="CustomResponse" statusCode="403" subStatusCode="1" statusReason="Access Forbidden" />
        </rule>
        <rule name="hidden to gulp" stopProcessing="true">
        <match url="^gulp/" />
          <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
          </conditions>
          <action type="CustomResponse" statusCode="403" subStatusCode="1" statusReason="Access Forbidden" />
        </rule>
        <!-- Rewrite URLs of the form 'x' to the form 'index.php/x'. -->
        <rule name="Short URLs" stopProcessing="true">
          <match url="^(.*)$" ignoreCase="false" />
          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
            <add input="{URL}" pattern="^(.*)\.(gif|png|jpe?g|css|ico|js|svg|map)$" ignoreCase="false" negate="true" />
          </conditions>
          <action type="Rewrite" url="index.php/{R:1}" appendQueryString="true" />
        </rule>
      </rules>
    </rewrite>

    <security>
      <requestFiltering>
        <hiddenSegments>
          <add segment="app" />
          <add segment="src" />
          <add segment="tests" />
          <add segment="var" />
          <add segment="codeception" />
          <add segment="bin" />
          <add segment="dockerbuild" />
          <add segment=".devcontainer" />
        </hiddenSegments>
        <denyUrlSequences>
          <add sequence="composer" />
          <add sequence="autoload" />
          <add sequence="COPYING" />
          <add sequence="Dockerfile" />
          <add sequence="docker-compose.yml" />
          <add sequence=".env" />
          <add sequence=".maintenance" />
          <add sequence=".htaccess" />
          <add sequence=".dockerignore" />
          <add sequence=".editorconfig" />
          <add sequence="Procfile" />
          <add sequence="/app.json" />
          <add sequence="/gulpfile.js" />
          <add sequence="/package.json" />
          <add sequence="/package-lock.json" />
          <add sequence=".git" />
          <!-- see https://technet.microsoft.com/ja-jp/library/ee431583.aspx#EEA -->
          <add sequence=".." />
          <add sequence=":" />
          <add sequence="\" />
        </denyUrlSequences>
        <fileExtensions>
          <add fileExtension=".ini" allowed="false" />
          <add fileExtension=".lock" allowed="false" />
          <add fileExtension=".dist" allowed="false" />
          <add fileExtension=".sh" allowed="false" />
          <add fileExtension=".bak" allowed="false" />
          <add fileExtension=".swp" allowed="false" />
          <add fileExtension=".yaml" allowed="false" />
          <add fileExtension=".yml" allowed="false" />
          <add fileExtension=".twig" allowed="false" />
          <add fileExtension=".cache" allowed="false" />
        </fileExtensions>
      </requestFiltering>
    </security>

    <defaultDocument>
      <!-- Set the default document -->
      <files>
        <remove value="index.php" />
        <add value="index.php" />
      </files>
    </defaultDocument>
  </system.webServer>
</configuration>