Protect files and folders with web.config

Enabling Access to Bin, App_Code, App_Data and other ASP.NET Protected Folders
location Element
Configuring Specific Files and Subdirectories
httpHandlers Element
Protecting Files with ASP.NET
How to: Configure Specific Directories Using Location Settings
Locking Configuration Settings
Setting authorization rules for a particular page or folder in web.config
Simple File Download Protection with ASP.NET