<configuration>
  <system.applicationHost>
    <!-- ... -->
    <sites>
      <site name="Default Web Site" id="1">
        <application path="/">
          <virtualDirectory path="/" physicalPath="%SystemDrive%inetpubwwwroot" />
          <virtualDirectory path="/Staging" physicalPath="C:inetpubwwwrootStaging" allowSubDirConfig="false" />
        </application>
    <bindings> <!-- ... --> </bindings>
  </site>

<system.webServer>
  <security>
    <requestFiltering>
      <hiddenSegments>
        <clear />
      </hiddenSegments>
      <fileExtensions>
        <clear />
      </fileExtensions>
    </requestFiltering>
  </security>