Remove Unwanted HTTP Response Headers
he purpose of this blog post is to discuss how to remove unwanted HTTP response headers from the response. Typically we have 3 response headers which many people want to remove for security reason.
Server- Specifies web server version.
X-Powered-By- Indicates that the website is "powered by ASP.NET."
X-AspNet-Version- Specifies the version of ASP.NET used.
Before you go any further, you should evaluate whether or not you need to remove these headers. If you have decided to remove these headers because of a security scan on your site, you may want to read the following blog post by David Wang.
If you would like to go ahead and remove the headers then follow the following options.
ServerHeader
There are three ways to remove the Server header from the response. The best one is to use the third option.
1.Using the Registry key.
Create a DWORD entry calledDisableServerHeaderin the following Registry key and set the value to1.
HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
After adding the Registry key, restart the HTTP service using thenet stop httpcommand and thenet start httpcommand. If the HTTP service doesn’t start up then use theiisresetcommand. If that also doesn’t work then you can restart the server.
Please note that this method is used only when the Server header comes as “Microsoft-HTTPAPI/2.0”.
When the request comes to IIS, it is first goes to http.sys driver. HTTP.SYS driver either handle the request on its own or send it to User mode for further processing. W