Generally, an ASP.NET website published on a third-party server (host) is (pre)compiled in a non-updatable way to avoid code modification.
About source code access
First point, precompilation as Steven said. Depending on your project type, if you don't precompile, the source code (*.cs
in C# or *.vb
in VB.NET) will be in the deployment package and present in your web site root. By default, it cannot be downloaded via the webserver because of the file extensions but these files are accessible on the file system.
Note that if you precompile in an updatable mode, the content of your .aspx
, .ascx
and .master
will be readable. Check the link above.
Second point, reverse-engineering : even if you compile and make the effort to put the maximum of your code logic in your compiled code -ie. assemblies-, the source code is fully readable in your assemblies through 'spy' tools. Furthermore, these assemblies can be decompiled -and the source code is back-.
Finally, if you want to prevent source code theft, you have to obfuscate your code (assemblies). The role of obfuscation is to make the code unreadable by scattering the sources (classes and methods) and renaming the variables. The code in your final assemblies will be incomprehensible for a human.
It can be somehow decompiled but your code logic will be more difficult to analyze. There is a bunch of obfuscation tools. I like Eazfuscator .NET (last free version is 3.3).
Take a look : 7 Ways to Protect your .NET Code from Reverse-Engineering