Block Autodiscover requests | recipes

Have you noticed unusual requests in your website logs for URLs like /autodiscover.xml or /autodiscover.svc? If your website doesn't host a Microsoft Exchange server, these entries can be quite puzzling and, over time, add significant noise to your analytics and server logs.

These requests originate from Microsoft Exchange Autodiscover. This service is designed to help email clients like Outlook automatically configure user mailboxes by attempting to locate Exchange server settings. When a client tries to connect, it often makes a series of educated guesses, including looking for an autodiscover.xml or autodiscover.svc file at various common locations on a domain's web server. If your website is serving the domain where an Exchange client is looking for Autodiscover, these requests will hit your server, most likely resulting in 404 "Not Found" errors.

While these requests are harmless in themselves for non-Exchange sites, they can become a nuisance, cluttering your logs and potentially consuming unnecessary server resources, especially on high-traffic sites.

This recipe offers a straightforward solution to this common issue. After installing this recipe, your website will immediately respond with a 404 Not Found status code for any requests matching these specific Autodiscover patterns. More importantly, this response will occur at an early stage, preventing these requests from being fully processed by your application and drastically reducing the "noise" in your server logs - and also the workload for your backend servers. This ensures your logs remain clean and focused on legitimate website traffic, allowing you to monitor and analyze your site's performance more effectively.