Remove IIS Server version HTTP Response Header

How to remove HTTP response headers in IIS 7, 7.5, 8.0, 8.5, and ASP.NET. Windows Server IIS loves to tell the world that a website runs on IIS, it does so with the Server header in the HTTP response, as shown below. In this post I’ll show you how to remove response server headers in IIS. You don’t want to give hackers too much information about your servers, heh? ;-).

Normal HTTP Response headers

Even though I’m not a big fan of security by obscurity (are you?), removing common server response headers is often advised by security experts. Attackers might gain a lot of information about your server and network, just by looking at the response headers a web server returns.

Therefore it’s advised to remove at least some of them.

This is what a normal HTTP HEAD response looks like:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:05:34 GMT
Connection: close

And here IIS displays its version information in a Server header as response:

Server: Microsoft-IIS/8.0

As with removing ETag headers in IIS, you can rewrite and empty the Server: HTTP response header in IIS with a URL Rewrite outboundRule.

Remove Server response header with an outboundRule URL Rewrite rule

On IIS 7+ (IIS 7, 8.5, 8.0, 8.5), you can use a rewrite to remove the Server: header from the response.

You can use the following URL Rewrite Outbound rule:

<rewrite>    
  <outboundRules rewriteBeforeCache="true">
    <rule name="Remove Server header">
      <match serverVariable="RESPONSE_Server" pattern=".+" />
      <action type="Rewrite" value="" />
    </rule>
  </outboundRules>
</rewrite>

What the outboundRule does is: it looks for the header – or serverVariable – Server: in the output response stream, and rewrites the value with an empty string (nothing).

The end result is an empty Server: response header line:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:06:08 GMT
Connection: close

You’ve now successfully removed the Server response header!

This is a website-specific rule. If you want to create the rule for all of your applications, create the rule at the server level. Also, some applications, especially third party applications, may require the Server header, so you may need to remove this rule for those applications.

Rewrite Server: Microsoft-IIS/8.0 with your own information – just for the fun

The fun part of rewriting response headers is that you can display your own string, for example by giving in an value in the Rewrite action, that message is displayed:

<action type="Rewrite" 
  value="Saotn Server Software systems, LTD." />

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server: Saotn Server Software systems, LTD.
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 11:19:16 GMT
Connection: close

Fun, heh :)

Remove X-Powered-By header in IIS using web.config customHeaders

By default IIS tells the world it’s powered by ASP.NET, by placing an X-Powered-By header:

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-Powered-By: ASP.NET
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:07:37 GMT
Connection: close

This response header can be removed with a customHeaders setting in web.config, placed in the <system.webServer> node:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

Now the X-Powered-By header is removed from the response header output

HTTP/1.1 200 OK
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Server:
X-UA-Compatible: IE=Edge,chrome=1
Date: Sun, 06 Jul 2014 10:10:02 GMT
Connection: close

X-AspNet-Version header

The X-AspNet-Version HTTP Header broadcasts to the world what version of ASP.NET is being used. Add the following content inside the <system.web> node in your application’s web.config file:

<httpRuntime
  enableVersionHeader="false" />

Remove HTTP headers in Global.asax

ASP.NET programmers may also remove or change server HTTP response headers through a global.asax file In your global.asax.cs add this:

See the #Protip below for why not to use this code with managed modules that implement IHttpModule:

protected void Application_PreSendRequestHeaders()
{
  // Response.Headers.Remove("Server");
  Response.Headers.Set("Server","My httpd server");
  Response.Headers.Remove("X-AspNet-Version");
  Response.Headers.Remove("X-AspNetMvc-Version");
}

Pro Tip: an update, taken from Ilya Grebnov’s post edit on StackOverflow:

You can use the PreSendRequestHeaders and PreSendRequestContext events with native IIS modules, but do not use them with managed modules that implement IHttpModule. Setting these properties can cause issues with asynchronous requests. The correct version is to use BeginRequest event.

protected void Application_BeginRequest(object sender, EventArgs e)
{
  var application = sender as HttpApplication;
  if (application != null && application.Context != null)
  {
    application.Context.Response.Headers.Remove("Server");
  }
}

To remove X-AspNetMvc-Version in your Global.asax file, create/find the Application_Start event and add a line as follows:

protected void Application_Start()
{
  MvcHandler.DisableMvcResponseHeader = true;
}

Azure: Remove ‘Server’ And ‘X-Powered-By’ headers from your Azure websites

You can now hide the Server and X-Powered-By headers by adding an entry to your web.config system.webServer node:

<security>
  <requestFiltering removeServerHeader ="true" />
</security>

Extra IIS security measurements

For a safe website it’s important to take extra security measures, whether you host your website on Windows Server IIS, Linux Apache or Nginx. Below you’ll find some tips to tighten your website’s security.

• HackRepair.com's Bad Bots .htaccess translated to web.config, for IIS
• enable HSTS Strict-Transport-Security header in IIS
• How to remove IIS Server header
• Add SSL in WordPress. See my WordPress web.config for more information & examples
• Use .htaccess as a Web Application Firewall (WAF – 7 tips!), or filter web traffic with blacklists
• Also, don’t forget to secure the WordPress uploads folder by disabling PHP execution!

If you have a valuable tip, please let met know and drop me a comment.