Hi,

Thought I would post this in case it could help someone else.

Had an issue for a long time where I couldn't delete any forms or workflows, so yesterday I thought I'd take another look at trying to fix it.

Trying to delete a form or workflow would show the following errors in the backoffice:

Request error: The URL returned a 404 (not found): backoffice/UmbracoForms/Form/DeleteByGuid
Request error: The URL returned a 404 (not found): backoffice/UmbracoForms/Workflow/DeleteByGuid

I found a couple of threads that I followed through to see if they would help, but nothing would solve the 404 error.

https://our.umbraco.org/forum/umbraco-pro/contour/64202-Deleting-form-gives-404

• There was nothing in the Umbraco trace log.
• App_Plugins/UmbracoForms/Backoffice/Form/delete.html was present
• I tried adjusting permission on the App_Plugins/Forms/Data, even giving everyone full control
• And the managed pipline mode was alreadt set to Integrated

https://our.umbraco.org/forum/umbraco-7/using-umbraco-7/73122-cannot-delete-umbraco-form-or-form-workflow

• But WebDav is not installed on the server

I began thinking that something in IIS or our other server security software was blocking the request.

I did notice using the developer tools in Firefox that the request for these two URLs was not a GET or POST but a DELETE request.

I enabled Failed Request Tracing in IIS and found that it was being rejected by UrlScan because it is using the HTTP DELETE verb, in the log file the URL is actually changed to http://www.domain.com/Rejected-By-UrlScan?~/umbraco/backoffice/UmbracoForms/Form/DeleteByGuid?guid=d313c1d8-460b-43c5-b0b0-2535ce9eab07

I now know what is blocking it, but how to fix it?

I came across this page http://www.pressthered.com/rejected-by-urlscan404errors/ that says how to disable UrlScan (didn't want to do this) and how to configure it, by editing the UrlScan.ini file

I found some more info here https://www.iis.net/learn/extensions/working-with-urlscan/urlscan-3-reference so made some changes:

In the [AlwaysAllowedUrls] section of the UrlScan.ini file I added: /umbraco/backoffice/UmbracoForms/Form/DeleteByGuid
/umbraco/backoffice/UmbracoForms/Workflow/DeleteByGuid

So it now looks like this

[AlwaysAllowedUrls]
;
; URLs listed here will always be explicitly allowed by UrlScan
; and will bypass all UrlScan checks.  URLs must be listed
; with a leading '/' character.  For example:
;
;   /SampleURL.htm
;
/umbraco/backoffice/UmbracoForms/Form/DeleteByGuid
/umbraco/backoffice/UmbracoForms/Workflow/DeleteByGuid

And now forms & workflows can be deleted.

Another option that would probably work would be to globally allow the DELETE verb, but I wasn't so keen to do that.

Mike