Remove IIS Server version HTTP Response Header

Microsoft Internet Information Services logo

How to remove HTTP response headers in IIS 7, 7.5, 8.0, 8.5, and ASP.NET. Windows Server IIS loves to tell the world that a website runs on IIS, it does so with the Server header in the HTTP response, as shown below. In this post I’ll show you how to remove response server headers in IIS. You don’t want to give hackers too much information about your servers, heh? ;-).

Microsoft Internet Information Services logo

Microsoft Internet Information Services

Normal HTTP Response headers #

Even though I’m not a big fan of security by obscurity (are you?), removing common server response headers is often advised by security experts. Attackers might gain a lot of information about your server and network, just by looking at the response headers a web server returns.

Therefore it’s advised you remove at least some of them.

This is what a normal HTTP HEAD response looks like:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:05:34 GMT
Connection: close

And here you’ll notice IIS displaying its version information in a Server header, as response:

Server: Microsoft-IIS/8.0

As with removing ETag headers in IIS, you can rewrite and empty the Server: HTTP response header in IIS with a URL Rewrite outboundRule.

Remove Server response header with an outboundRule URL Rewrite rule #

Unfortunately you cannot really remove the Server header. But you can rewrite its content and empty it.
On IIS 7+ (IIS 7, 8.5, 8.0, 8.5), use an rewrite outboundRule to remove the web server version information from the Server: header response.

You can use the following URL Rewrite Outbound rule:

<rewrite>    
  <outboundRules rewriteBeforeCache="true">
    <rule name="Remove Server header">
      <match serverVariable="RESPONSE_Server" pattern=".+" />
      <action type="Rewrite" value="" />
    </rule>
  </outboundRules>
</rewrite>

What the outboundRule does is: it looks for the header – or serverVariable – Server: in the output response stream, and rewrites the value with an empty string (nothing).

This may interest you:   Send email with Ghost using SMTP authentication and TLS encryption

The end result is an empty Server: response header line:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:06:08 GMT
Connection: close

You’ve now successfully removed the Server version response from the HTTP headers!

This is a website-specific rule. If you want to create the rule for all of your applications, create the rule at the server level. Also, some applications, especially third party applications, may require the Server header, so you may need to remove this rule for those applications.

Rewrite Server: Microsoft-IIS/8.0 with your own information – just for the fun

The fun part of rewriting response headers is that you can display your own string, for example by giving in an value in the Rewrite action, that message is displayed:

<action type="Rewrite" 
  value="Saotn Server Software systems, LTD." />
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Saotn Server Software systems, LTD.
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 11:19:16 GMT
Connection: close

Fun, heh :)

Remove X-Powered-By header in IIS using web.config customHeaders #

By default IIS tells the world it’s powered by ASP.NET, by placing an X-Powered-By header:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-Powered-By: ASP.NET
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:07:37 GMT
Connection: close

This response header can be removed with a customHeaders setting in web.config, placed in the <system.webServer> node:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

Now the X-Powered-By header is removed from the response header output

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:10:02 GMT
Connection: close

X-AspNet-Version header #

The X-AspNet-Version HTTP Header broadcasts to the world what version of ASP.NET is being used. Add the following content inside the <system.web> node in your application’s web.config file:

<httpRuntime
  enableVersionHeader="false" />

Remove HTTP headers in Global.asax #

ASP.NET programmers may also remove or change server HTTP response headers through a global.asax file In your global.asax.cs add this:

This may interest you:   IIS application pool recycle on specific times, not regular time interval

See the #Protip below for why not to use this code with managed modules that implement IHttpModule:

protected void Application_PreSendRequestHeaders()
{
  // Response.Headers.Remove("Server");
  Response.Headers.Set("Server","My httpd server");
  Response.Headers.Remove("X-AspNet-Version");
  Response.Headers.Remove("X-AspNetMvc-Version");
}

Pro Tip: an update, taken from Ilya Grebnov’s post edit on StackOverflow:

You can use the PreSendRequestHeaders and PreSendRequestContext events with native IIS modules, but do not use them with managed modules that implement IHttpModule. Setting these properties can cause issues with asynchronous requests. The correct version is to use BeginRequest event.

protected void Application_BeginRequest(object sender, EventArgs e)
{
  var application = sender as HttpApplication;
  if (application != null && application.Context != null)
  {
    application.Context.Response.Headers.Remove("Server");
  }
}

To remove X-AspNetMvc-Version in your Global.asax file, create/find the Application_Start event and add a line as follows:

protected void Application_Start()
{
  MvcHandler.DisableMvcResponseHeader = true;
}

Azure: Remove ‘Server’ And ‘X-Powered-By’ headers from your Azure websites #

You can now hide the Server and X-Powered-By headers by adding an entry to your web.config system.webServer node:

<security>
  <requestFiltering removeServerHeader ="true" />
</security>

Show your support


If you want to step in to help me cover the costs for running this website, that would be awesome. Just use this link to donate a cup of coffee ($5 USD for example). And please share the love and help others make use of this website. Thank you very much!


About the Author Jan Reilink

My name is Jan. I am not a hacker, coder, developer, programmer or guru. I am merely a system administrator, doing my daily thing at Vevida in the Netherlands. With over 15 years of experience, my specialties include Windows Server, IIS, Linux (CentOS, Debian), security, PHP, websites & optimization.

follow me on:

Leave a Reply

21 Comments on "Remove IIS Server version HTTP Response Header"

avatar
  Subscribe  
newest oldest most voted
Notify of
Kunal Maurya
Guest

Is there any way to completely remove “Server: Microsoft-IIS/8.0” from a site having static pages only like ?

Jan Reilink
Guest

Hi Kunal, thank you for your comment.
An IIS Outbound Rule rewrites the output stream (HTTP response), so it’ll also remove the Server header from static HTML files.

oliverbill
Guest

This article was very helpful. The $2 donation is worth it.

Ansonmus
Guest

I’ve a issue with the solution.
I can do a request to /blalbla.axd (every name possible) and then the “Server” variable will have a value…

Ansonmus
Guest

Thanks for the answer, do you have any idea how to fix this?

Ansonmus
Guest

We have tried it. But it doen’t work. Probably because of this line (MVC…): routes.IgnoreRoute(“{resource}.axd/{*pathInfo}”);

AErot
Guest

Hi, great article, but I’ve got question/problem..

At the first glance all seems be well, I receive modified http headers, but when I send request to doesn’t exists page (and server will return 404 webpage) server name is ‘IIS 8.5’ in the HTTP headers..

I found what is a problem – custom error pages.

When I remove httpErrors elements from web.config, Server Name header isn’t display in HTTP headers (in both cases – correct/incorrect webpage url).

How can I fix it ? (I want to have custom error pages and remove Server Name header..)

Regards
AErot

Jan R
Guest

Hi @disqus_E1570bwNoJ:disqus , thank you for your comment. Interesting… What are you using, PHP or ASP.NET, and which solution do you use to remove the Server: header? It might be a .NET Framework thingy.

AErot
Guest

Hi Jan R, thanks for quick response. I use your method: URL Rewrite Module Outbound Rule on IIS8. Actually I created topic on forums.iis.net ( http://forums.iis.net/t/1233506.aspx?How+to+remove+Server+Name+Microsoft+IIS+8+5+from+HTTP+headers+ ) (where is my config file), but I have not received accurate answer yet.

I’m still looking for help..

Regards
AErot

Jan R
Guest

I’ve seen your web.config in that thread. Maybe you have to add existingResponse= to your custom httpErrors node? See http://stackoverflow.com/a/31041696/1297898 for more information.

AErot
Guest

Bullseye! It looks like it’s working with Passthrough :) I must think about error page in ASP.NET. Thx!

Best
AErot

Jan R
Guest

Nice find @disqus_E1570bwNoJ:disqus , if you have the relevant web.config lines for me (and the scripting language you use: ASP.NET, PHP or ASP), I can add it to this post. Thanks in advance!

Vijaikanth N
Guest

Hi,

When i set the existingResponse=passthrough, the server information is not displayed for the 404 status code but my custom error pages defined in IIS stopped working. Is there any workaround for this?

PRS
Guest

what is the impact,if application caching having both
Custom HTTP Response Header +set common HTTP response header

Nishant
Guest

Removing the server variable from response using url rewrite outbound rules is not working . application is angular 4 application and My server is windows 8 with iis 8.5 and I have my web.config data as shown below .

Pablo
Guest

I am using IIS 8.5 and whenever I attempt to use in my web.config IIS does not like it. I’ve seen that this only works on IIS7 or other versions. Is there a workaround or other method to remove the ASP version?

Pablo
Guest

looks like it removed my code ” ” in my comment above

Pablo
Guest

one more try httpRuntime enableVersionHeader “false”