diff --git a/public/web.config b/public/web.config
new file mode 100644
index 0000000..753f8d8
--- /dev/null
+++ b/public/web.config
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <system.webServer>
+        <defaultDocument>
+            <files>
+                <clear />
+                <add value="Index.php" />
+            </files>
+        </defaultDocument>
+        <rewrite>
+            <rules>
+                <rule name="Disallow .git" stopProcessing="true">
+                    <match url="/\.git" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Disallow auth.json" stopProcessing="true">
+                    <match url="^auth\.json$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Disallow composer.lock and json" stopProcessing="true">
+                    <match url="^composer\.(lock|json)$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Disallow config.php" stopProcessing="true">
+                    <match url="^config.php$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Imported Rule" stopProcessing="true">
+                    <match url="^flarum$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Disallow storage directory" stopProcessing="true">
+                    <match url="^storage/(.*)?$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Disallow vendor directory" stopProcessing="true">
+                    <match url="^vendor/(.*)?$" ignoreCase="false" />
+                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
+                </rule>
+                <rule name="Handle index.php re-write" stopProcessing="true">
+                    <match url="^" ignoreCase="false" />
+                    <conditions logicalGrouping="MatchAll">
+                        <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
+                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
+                    </conditions>
+                    <action type="Rewrite" url="index.php" appendQueryString="true" />
+                </rule>
+            </rules>
+        </rewrite>
+  </system.webServer>
+</configuration>