How to delete IIS custom headers like X-Powered-By: ASP.NET from response?

Question

In IIS 7.0 integrated mode after deleting all headers with Response.ClearHeaders() IIS would add some other headers like Server and X-Powered-By which reveals good information to hackers. How can I stop this behavior (consider I still need to add my custom headers) ?

Answer 1

You can add this to your Web.Config:

<system.webServer>     <httpProtocol>         <customHeaders>             <remove name="X-Powered-By" />         </customHeaders>     </httpProtocol> </system.webServer> 

Update: if you're using the MVC framework I would also recommend removing the X-AspNetMvc-Version and X-AspNet-Version headers as well. This is accomplished by setting MvcHandler.DisableMvcResponseHeader = true in your Global.asax file and <system.web><httpRuntime enableVersionHeader="false" /></system.web> in your Web.config respectively.

Answer 2

The X-Powered-By is configured within IIS. On Windows 7 it's specifically:

1. IIS Manager
2. COMPUTER NAME > Sites > Default Web Site
3. HTTP Respons Headers
4. Remove X-Powered-By

I'm not sure what generates the Server header though.