diff --git a/public/web.config b/public/web.config
index 753f8d8..b9d7cba 100644
--- a/public/web.config
+++ b/public/web.config
@@ -9,34 +9,14 @@
         </defaultDocument>
         <rewrite>
             <rules>
-                <rule name="Disallow .git" stopProcessing="true">
-                    <match url="/\.git" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Disallow auth.json" stopProcessing="true">
-                    <match url="^auth\.json$" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Disallow composer.lock and json" stopProcessing="true">
-                    <match url="^composer\.(lock|json)$" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Disallow config.php" stopProcessing="true">
-                    <match url="^config.php$" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Imported Rule" stopProcessing="true">
-                    <match url="^flarum$" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Disallow storage directory" stopProcessing="true">
-                    <match url="^storage/(.*)?$" ignoreCase="false" />
-                    <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
-                </rule>
-                <rule name="Disallow vendor directory" stopProcessing="true">
-                    <match url="^vendor/(.*)?$" ignoreCase="false" />
+                <!-- Uncomment the rule below if you are not using the `public` directory to
+                prevent sensitve resources from being exposed -->
+                <!--
+                <rule name="Disallow sensitive directories" stopProcessing="true">
+                    <match url="^/(\.git|composer\.(json|lock)|auth\.json|config\.php|flarum|storage|vendor)" ignoreCase="false" />
                     <action type="CustomResponse" url="/" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
                 </rule>
+                -->
                 <rule name="Handle index.php re-write" stopProcessing="true">
                     <match url="^" ignoreCase="false" />
                     <conditions logicalGrouping="MatchAll">