Applicationhost.config updates for HTTP Slow Post with Azure Websites

Question

We are trying to update our Azure websites to not show as vulnerable to the HTTP Slow Post vulnerability. Some articles suggest fixing this by updating the applicationHost.config via IIS to update the connection timeout values. Obviously with Azure websites,
we don't have access to IIS. Came across some options with Kudu and XDT to modify the application host file, as outlined on these two sites:
http://azure.microsoft.com/en-us/documentation/articles/web-sites-transform-extend/#transform
http://rtigger.com/blog/2014/03/31/number-til-modifying-you-azure-applicationhost-dot-config
Currently am using the following as our applicationHost.xdt (I have this both in our application root, as well as in a SiteExtensions folder as I wasn't clear which one was required).
<?xml version="1.0"?> 
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform"> 
<system.applicationHost>
        <sites>
            <siteDefaults>
                <limits connectionTimeout="00:00:30"
xdt:Transform="Insert" />
            </siteDefaults>
            <applicationDefaults applicationPool="DefaultAppPool" />
            <virtualDirectoryDefaults allowSubDirConfig="true" />
        </sites>
        <webLimits connectionTimeout="00:00:30"
xdt:Transform="Insert" />
</system.applicationHost>
</configuration> 
We also set the WEBSITE_PRIVATE_EXTENSIONS app-setting to 1 as instructed.
When testing our site using a 3rd party tool, it appears the setting is not getting applied. Hoping someone can point out where our error may be. Alternatively, is there any way to see what the current applicationHost.config is for our website? I'm curious
if our XDT is correctly being applied, so if we could see what the resulting file was that may also allow us to further troubleshoot.
Thanks in advance for any advise!

Answer 1

Please see
this page, which has detailed steps on finding your applicationhost.config and finding the logs from the transformation. And please make sure that your applicationhost.xdt is in your
d:\home\site folder (and not in your site\wwwroot).
David