removing unnecessary http headers in iis and asp.net

Server Headers:

To remove Server headers there are multiple solutions

Solution 1:

Add the below code snippet in global.asax file

protected void Application_PreSendRequestHeaders()

        {

            Response.Headers.Remove("Server");

        }

Solution 2: (Preferred)

Download and install the latest version of urlscan tool (version 3.1) from the following link

32-Bit (x86):

http://www.microsoft.com/downloads/details.aspx?FamilyID=ee41818f-3363-4e24-9940-321603531989

64-Bit (x64):

http://www.microsoft.com/downloads/details.aspx?FamilyID=361e5598-c1bd-46b8-b3e7-3980e8bdf0de

After installing goto below location

C:\Windows\System32\inetsrv\urlscan

Open “UrlScan.ini” file in notepad as a Administrator

Update the value for RemoveServerHeader=1 from 0.

X-Powered-By Headers:

Solution 1:

Remove the X-Powered-By headers from IIS

Open IIS

Click on required website

Click on HTTP Response headers,

Right click on “X-Powered-By” and remove the header by clicking Yes

Solution 2:

Including the below lines to the <system.webServer> element of web.config

<httpProtocol>

      <customHeaders>

        <remove name="X-Powered-By" />

      </customHeaders>

</httpProtocol>

 X-AspNet-Version:

Solution 1:

In web.config add this under System.Web

<httpRuntime enableVersionHeader="false"/>

Solution 2:

Add the below code snippet in global.asax file

protected void Application_PreSendRequestHeaders()

        {

            Response.Headers.Remove("X-AspNet-Version ");

        }