I want to setup a website that can't execute any server side code (asp, asp.net, etc.).

I've tried using an application pool that has "No Managed Code" as the .NET Framework version, but classic asp code still executes. 

I tried removing all ISAPI Filters but that didn't help.

Removing the ".asp" Handler Mapping worked. Should I remove all \*.[ext] handlers to lock it down further?

I still need to run code on some sites, but I'd like to be able to offer vanilla web hosting on sites as needed.