web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="Redirect to HTTPS" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="^OFF$" />
                    </conditions>
           <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" />
                </rule>
                <rule name="Deny Direct Access" enabled="true" stopProcessing="true"> 
   <match url=".*\.(mp3|ogg|aac|flac|jpg|jpeg|bmp|png|gif|lrc|php)$" /> 
   <conditions>
                        <add input="{HTTP_REFERER}" pattern="^https://subdomain.domain\.com/.*$" negate="true" /> 
   </conditions> 
   <action type="CustomResponse" statusCode="403" statusReason="Denied" statusDescription="Direct Access Denied" /> 
 </rule> 

            </rules>
        </rewrite>
        <directoryBrowse enabled="false" />
        <security>
            <requestFiltering>
                <hiddenSegments>
                    <add segment="send.php" />
                </hiddenSegments>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>