Remove HTTP response headers in IIS 7, 7.5, 8.0, 8.5, 10 and ASP.NET

Windows Server IIS loves to tell the world that a website runs on IIS. It does so with the Server header in the HTTP response, as shown below. In this post I’ll show you how to remove response server headers in IIS. You don’t want to give hackers too much information about your servers, heh? ;-).

Microsoft Internet Information Services logo
Microsoft Internet Information Services

Normal HTTP Response headers

Even though I’m not a big fan of security by obscurity (are you?), removing common server response headers is often advised by security experts. Attackers might gain a lot of information about your server and network, just by looking at the response headers a web server returns.

Therefore it’s advised you remove at least some of them.

But let’s start with how a normal HTTP HEAD response looks like:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:05:34 GMT
Connection: close

Here you notice IIS displaying its version information in a Server header, as response:

Server: Microsoft-IIS/8.0

As with removing ETag headers in IIS, you can rewrite and empty the Server: HTTP response header in IIS with a URL Rewrite outboundRule.

Remove Server response header with an outboundRule URL Rewrite rule

Unfortunately you cannot really remove the Server header. But you can rewrite its content and empty it.
On IIS 7+ (IIS 7, 8.5, 8.0, 8.5), use an rewrite outboundRule to remove the web server version information from the Server: header response.

You can use the following URL Rewrite Outbound rule:

<rewrite>    
  <outboundRules rewriteBeforeCache="true">
    <rule name="Remove Server header">
      <match serverVariable="RESPONSE_Server" pattern=".+" />
      <action type="Rewrite" value="" />
    </rule>
  </outboundRules>
</rewrite>

What the outboundRule does is: it looks for the header – or serverVariable – Server: in the output response stream, and rewrites the value with an empty string (nothing).

The end result is an empty Server: response header line:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:06:08 GMT
Connection: close

You’ve now successfully removed the Server version response from the HTTP headers!

This is a website-specific rule. If you want to create the rule for all of your applications, you have to create the rule at the server level. Also, some applications, especially third party applications, may require and depend on the Server header. Then you may need to remove this rule for those applications.

Rewrite ‘Server: Microsoft-IIS/8.0’ with your own server information – just for the fun

The fun part of rewriting response headers is that you can display your own information string. For example, if you give in an value in the Rewrite action, that message is displayed:

<action type="Rewrite" 
  value="Saotn Server Software systems, LTD." />
HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Saotn Server Software systems, LTD.
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 11:19:16 GMT
Connection: close

Fun, heh 🙂

Remove ASP.NET X-Powered-By header in IIS using web.config customHeaders

By default IIS tells the world it’s powered by ASP.NET, by placing an X-Powered-By header:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-Powered-By: ASP.NET
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:07:37 GMT
Connection: close

This response header can be removed with a customHeaders setting in web.config, placed in the <system.webServer> node:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

Now the X-Powered-By header is removed from the response header output

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:10:02 GMT
Connection: close

X-AspNet-Version header

The X-AspNet-Version HTTP Header broadcasts to the world what version of ASP.NET is being used. Add the following content inside the <system.web> node in your application’s web.config file:

<httpRuntime
  enableVersionHeader="false" />

removeServerHeader requestFiltering in IIS 10.0

In IIS 10.0 (Windows Server 2016/2019), you can remove the Server header by configuring requestFiltering in your web.config system.webServer node:

<security>
  <requestFiltering removeServerHeader ="true" />
</security>

This way you don’t have to fiddle with complex outbound rewrite rules.

To remove ASP.NET’s X-Powered-By header you still need the customHeaders section as mentioned above.


Want to say thanks?

If I’ve helped you out and you want to thank me, why not buy me a coffee?

If I’ve helped you out and you want to thank me, why not buy me a coffee?

Thank you for your support. ♥


Jan Reilink

My name is Jan. I am not a hacker, coder, developer, programmer or guru. I am merely a system administrator, doing my daily thing at Vevida in the Netherlands. With over 15 years of experience, my specialties include Windows Server, IIS, Linux (CentOS, Debian), security, PHP, WordPress, websites & optimization. Want to support me and donate? Use this link: https://paypal.me/jreilink.

36 Comments

Lonnie Ables · 12 February 2019 at 21:27

How do you remove-unwanted-http-response-headers if you’re using adfs 3.0 since it’s not using iis?

David · 26 September 2018 at 03:43

Thanks Jan. Great article i removed iis server headers successfully.

    Jan Reilink · 26 September 2018 at 09:00

    Great to hear David, thank you for your feedback 🙂

Ulli · 12 September 2018 at 16:35

To remove all instances of the header (incl. on 404, etc. responses) or for self hosted services:
https://blogs.msdn.microsoft.com/dsnotes/2017/12/18/wswcf-remove-server-header/

Ankit · 7 September 2018 at 15:44

Hi,

I am getting the Server Name as “Microsoft-IIS/8.5” even after rewriting the server name as “” in the Error pages. Following is the web.config code:

    Jan Reilink · 7 September 2018 at 15:54

    Hi Ankit,

    Unfortunately your web.config code got lost in the comment. But what do you mean with “in the Error pages”, like the default IIS error pages located in C:\inetpub\custerr\en-US? Or somewhere else? Perhaps you have to use existingResponse=passthrough too? See the other comments.

      Ankit · 12 September 2018 at 08:24

      Hi Jan,

      I am redirecting the error to the custom error pages like

      and I am using the following to remove/rename the Server Name:

      But, then also Server Name is coming in the custom error pages. How to remove the server name from the custom error pages?

        Jan Reilink · 12 September 2018 at 08:41

        Hi Ankit,
        Your code isn’t coming through, please use a gist if possible and link to there, or wrap your code nicely in `<code></code>` tags.

          Ankit · 12 September 2018 at 09:00

          Hi Jan,

          Thanks for the advice. I hope this time my code is visible.

          I am developing a mobile friendly application using MEAN. So. my issue is that I want to remove/hide/rename the Server Name from all the pages. I am able to do so in all the pages except the custom error pages. I am redirecting the error to the custom error pages like:

          and I am using the following to remove/rename the Server Name:

          But, then also Server Name is coming in the custom error pages. How to remove the server name from the custom error pages?

          ANKIT · 12 September 2018 at 09:25

          Hi Jan,

          Actually, the issue is that the server name is visible in the HTTP Headers. Using the outbound rule in web.config, the server name is removed from the web pages but it is not removed from the custom error pages to which I am redirecting. I have also used errorMode=”Custom” existingResponse=”PassThrough” but it’s still coming.

Rikin Patel · 31 August 2018 at 07:20

When I used below code

protected void Application_BeginRequest(object sender, EventArgs e)
{
var application = sender as HttpApplication;
if (application != null && application.Context != null)
{
application.Context.Response.Headers.Remove(“Server”);
}
}
Then I am getting following error.
Error: This operation requires IIS integrated pipeline mode

More Info: I am using IIS 10, website hosting as Application and Application pool as Classic mode. If I changed to Integrated mode then working fine. But right now I can not change to this on Production environment because it may create other issue.

So, can you please suggest best solution in this situation.

    Jan Reilink · 31 August 2018 at 09:14

    Hi Rikin, thank you for your comment!

    I’m not a fan of Classic mode application pools. Why would you want to have IIS 6.0 behaviour? I’d say, fix the problems you have switching to Integrated mode, and move on from there turning off response headers. If Integrated mode is really not an option, try to use web.config settings to disable headers.

    HTH!

Anonymous · 3 August 2018 at 15:45

Thanks for the help!

Ron Hinds · 13 June 2018 at 00:35

I also have a rule that redirects http requests to https. But the redirect sends back all headers, including the Server: header. This is the http rule:

This is from the Microsoft URL Rewrite reference page:

Usage of a Redirect action implies that no subsequent rules evaluated for the current URL after redirection is performed.

Is there any way to remove the server header on a redirect?

Pablo · 15 November 2017 at 17:19

I am using IIS 8.5 and whenever I attempt to use in my web.config IIS does not like it. I’ve seen that this only works on IIS7 or other versions. Is there a workaround or other method to remove the ASP version?

    Pablo · 15 November 2017 at 17:22

    looks like it removed my code ” ” in my comment above

      Pablo · 15 November 2017 at 17:23

      one more try httpRuntime enableVersionHeader “false”

Nishant · 5 September 2017 at 05:21

Removing the server variable from response using url rewrite outbound rules is not working . application is angular 4 application and My server is windows 8 with iis 8.5 and I have my web.config data as shown below .

PRS · 12 December 2016 at 13:05

what is the impact,if application caching having both
Custom HTTP Response Header +set common HTTP response header

AErot · 15 September 2016 at 07:44

Hi, great article, but I’ve got question/problem..

At the first glance all seems be well, I receive modified http headers, but when I send request to doesn’t exists page (and server will return 404 webpage) server name is ‘IIS 8.5’ in the HTTP headers..

I found what is a problem – custom error pages.

When I remove httpErrors elements from web.config, Server Name header isn’t display in HTTP headers (in both cases – correct/incorrect webpage url).

How can I fix it ? (I want to have custom error pages and remove Server Name header..)

Regards
AErot

    Jan R · 15 September 2016 at 08:26

    Hi @disqus_E1570bwNoJ:disqus , thank you for your comment. Interesting… What are you using, PHP or ASP.NET, and which solution do you use to remove the Server: header? It might be a .NET Framework thingy.

      AErot · 15 September 2016 at 09:53

      Hi Jan R, thanks for quick response. I use your method: URL Rewrite Module Outbound Rule on IIS8. Actually I created topic on forums.iis.net ( http://forums.iis.net/t/1233506.aspx?How+to+remove+Server+Name+Microsoft+IIS+8+5+from+HTTP+headers+ ) (where is my config file), but I have not received accurate answer yet.

      I’m still looking for help..

      Regards
      AErot

        Jan R · 15 September 2016 at 10:10

        I’ve seen your web.config in that thread. Maybe you have to add existingResponse= to your custom httpErrors node? See http://stackoverflow.com/a/31041696/1297898 for more information.

          AErot · 15 September 2016 at 11:50

          Bullseye! It looks like it’s working with Passthrough 🙂 I must think about error page in ASP.NET. Thx!

          Best
          AErot

          Jan R · 15 September 2016 at 15:27

          Nice find @disqus_E1570bwNoJ:disqus , if you have the relevant web.config lines for me (and the scripting language you use: ASP.NET, PHP or ASP), I can add it to this post. Thanks in advance!

          Vijaikanth N · 24 September 2016 at 11:43

          Hi,

          When i set the existingResponse=passthrough, the server information is not displayed for the 404 status code but my custom error pages defined in IIS stopped working. Is there any workaround for this?

Ansonmus · 25 May 2016 at 15:43

We have tried it. But it doen’t work. Probably because of this line (MVC…): routes.IgnoreRoute(“{resource}.axd/{*pathInfo}”);

Ansonmus · 25 May 2016 at 15:13

Thanks for the answer, do you have any idea how to fix this?

Ansonmus · 25 May 2016 at 13:25

I’ve a issue with the solution.
I can do a request to /blalbla.axd (every name possible) and then the “Server” variable will have a value…

    J. Reilink · 25 May 2016 at 14:46

    Hi Ansonmus, thanks for your comment.
    The .axd file type is handled by the .NET Framework and often falls beyond the scope of URL Rewrite.

oliverbill · 11 May 2016 at 23:11

This article was very helpful. The $2 donation is worth it.

Kunal Maurya · 20 October 2015 at 07:43

Is there any way to completely remove “Server: Microsoft-IIS/8.0” from a site having static pages only like ?

    Jan Reilink · 21 October 2015 at 10:55

    Hi Kunal, thank you for your comment.
    An IIS Outbound Rule rewrites the output stream (HTTP response), so it’ll also remove the Server header from static HTML files.

Umbraco CMS optimization - 11+ tips - Sysadmins of the North · 24 December 2018 at 09:09

[…] Want to learn more about HTTP headers? For example, learn how to remove IIS Server version header. […]

Leave a Reply

Your email address will not be published. Required fields are marked *

29 queries, 0.209 seconds running PHP version 7.3.2