Grant write, modify, delete access rights on website's folder

Your website executes under unique user account that by default has full control over the website's folder.

So your application can create, open, read, write and delete files and folders inside of your root folder.

If your application is executed in dedicated application pool than the dedicated pool’s account also have full control over the root folder of the website.

The permissions cannot be changed. If you need to hide parts of your website from direct download use protected folder.

For all possible configuration of your website permissions are set to full control over the root folder of your website

For sites hosted on Windows 2003 

If, when running ASP.Net application, you still unable to create file or update it, you have to check your Web.Config file for "<Identity impersonate..." tag and remove it.

The only exception is when the application tries to modify a file or folder in "Application_Start" event of Global.asax file. This is by design that user authenticated only after the Application_Start event. Before the user is authenticated your website runs under an identity of Application Pool which is "Network services". That account doesn't have access to the folder of your website.

To make it work you eather have to move the code that tries to modify files or folders out of the "Application_Start" event of the Global.asax file or inside the event you'll need to impersonate your user by code.