How to Remove ASP.NET server headers

These headers, such as "Server," "X-Powered-By," and "X-AspNet-Version," can potentially expose details about your server's technology stack, making it easier for attackers to exploit known vulnerabilities. Fortunately, you can easily remove or hide these headers to improve security.

How to Remove Sensitive HTTP Headers in IIS to Improve Security

1. Removing the "Server" HTTP Header

The "Server" header can reveal the type of web server you're using.

To prevent this from being exposed, follow these steps:

First, you need to install the IIS URL Rewrite module. You can download it from IIS.net.

After installing the module, modify the IIS configuration by adding an outbound rule to remove the "Server" header.

This can be done in the <system.webServer> section of your web.config file.

<system.webServer>        
    <rewrite>
      <outboundRules>
          <rule name="RemoveServerHeader">
              <match serverVariable="RESPONSE_SERVER" pattern=".+" />    <!-- Match the "Server" header -->
              <action type="Rewrite" />                                    <!-- Remove its value -->
          </rule>
      </outboundRules>
    </rewrite>
</system.webServer>

2. Removing the "X-Powered-By" HTTP Header

The "X-Powered-By" header often reveals the framework or technology used to power the web application, such as ASP.NET. To remove this header:

Add a rule in the <httpProtocol> section of your web.config to remove the "X-Powered-By" header.

<system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />  <!-- Remove "X-Powered-By" -->
      </customHeaders>
    </httpProtocol>    
</system.webServer>

3. Removing the "X-AspNet-Version" HTTP Header

To disable Version Header in httpRuntime you can set enableVersionHeader to false in the <httpRuntime> section of your web.config to hide the ASP.NET version header.

<system.web>
  <httpRuntime enableVersionHeader="false" />   <!-- Disable "X-AspNet-Version" -->
</system.web>

Here's a complete example of how your web.config might look after implementing these changes:

<system.webServer>        
    <rewrite>
      <outboundRules>
          <rule name="RemoveServerHeader">
              <match serverVariable="RESPONSE_SERVER" pattern=".+" />    <!-- Remove "Server" header -->
              <action type="Rewrite" />
          </rule>
      </outboundRules>
    </rewrite>    
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />     <!-- Remove "X-Powered-By" header -->
      </customHeaders>
    </httpProtocol>    
</system.webServer>
<system.web>
  <httpRuntime enableVersionHeader="false" />   <!-- Remove "X-AspNet-Version" header -->
</system.web>

These adjustments can improve the security posture of your IIS web server by limiting the information that can be exploited by attackers.