Home/ Questions/Q 1078457
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T21:43:39+00:00

IIS / ASP.NET sends HTTP headers to identify itself by default. Server Microsoft-IIS/7.5 X-AspNetMvc-Version

  • 0

IIS / ASP.NET sends HTTP headers to identify itself by default. 

Server               Microsoft-IIS/7.5
X-AspNetMvc-Version  2.0
X-AspNet-Version     4.0.30319
X-Powered-By         ASP.NET

Is there any reason not to remove these? Considering the ASP.NET vulnerabilities recently discovered, some people recommend changing the Server header to that of another server, such as Apache, to throw off scanners looking for affected websites. This seems like a good idea. Are there any unwanted side effects that I’m not thinking of?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I agree with Andrew, but for practical purposes yes this is possible (see here) and I am not aware of any negative side-effects – I believe these exist purely for stat-gathering and “advertising” purposes and the ubiquitous “reserved for future use”.

    • 0