How do I remove information-leaking headers in IIS?

Page Owner: Not Set
Last Reviewed: 2018-08-29

How do I remove sentitive headers, such as X-Powered-By and Server, in IIS? In other words, how do I make my web.config more secure? How do I prevent click-jacking?

Answer

The Server: header is put in automatically by IIS, but can be overwritten with an outgoing rewrite rule. In Web.config:

<rewrite>
  <outboundRules>
    <rule name="Remove RESPONSE_Server" >
      <match serverVariable="RESPONSE_Server" pattern=".+" />
      <action type="Rewrite" value="" />
    </rule>
  </outboundRules>
</rewrite>

The ASP.NET version header can also be removed in the Web.config. Add enableVersionHeader="false" to the httpRuntime element.

The MVC version header is most easily removed in in code. Add the following to your Application_Start in your Global.cs:

MvcHandler.DisableMvcResponseHeader = true;

The X-Powered-By header is an IIS default. It can be removed through the UI, or from the applicationHost.config IIS config file.

For example, you'd remove the <add ... /> line below:

    <httpProtocol>
        <customHeaders>
            <clear />
            <add name="X-Powered-By" value="ASP.NET" />
        </customHeaders>
    </httpProtocol>

It's also a good idea to add an X-Frame-Options: sameorigin header. This will prevent other sites from embedding your site as an iframe. This can be done in the Web.config:

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="SAMEORIGIN" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

Comments

As a note for the last suggestion, the X-Frame-Options snippet has "DENY" in the value -- when you want to make sure to use "SAMEORIGIN". DENY will cause the episerver admin panel to not load.
@TylerHecht I updated the snippet to be SAMEORIGIN instead.