This feature was removed in DNN 9. Although there is a ticket with DNN, adding this feature in a future release has not yet been decided.
You may still use the DotNetNuke.config file to manage request filters, however, you will need to enable Request filtering in the database. In order to be able to use the DotNetNuke.config file to manage your request filtering, you will still need to "allow" request filtering on the site. This has to be done in the database directly.
Please always take a backup before accessing the database. We suggest that you do not edit the database unless you feel experienced with making changes to the database.
To allow request filtering in the database, access your database and navigate to the HostSettings table. Locate the SettingName column and find "EnableRequestFilters". On the row for EnableRequestFilters find the column for SettingValue and change the cell content from "N" to "Y".
DNN 8 and below:
1. Login as a Superuser account
2. Navigate to Host > Host Settings > Other Settings
3. Check the box next to Enable Request Filters
4. Once checked click the Add New Rule button.
5. Fill out the required information
6. Click Save
IIS Server Variables: https://msdn.microsoft.com/en-us/library/ms524602(v=vs.90).aspx
The Request Filtering Rules are saved in the DotNetNuke.config file in the httpdocs folder