How to block PHP requests.

If you have rewrite section add new rule.
Be careful and backup old web.config.

        <rewrite>
            <rules>
                <clear />
            <rule name="BlockPHPfiles" patternSyntax="Wildcard">
                <match url="*" />
                <conditions>
                    <add input="{URL}" pattern="*.php*" />
                </conditions>
                <action type="AbortRequest" />
            </rule>
            </rules>
        </rewrite>