http-headersiis-8.5web-serverwindows-server-2012-r2
I have IIS 8.5 installed on my Windows server 2012 R2. I am trying to remove the Server: Microsoft-IIS/8.5 header from my responses.
I tried installed URLScan but it fails to install with the following error
IIS Metabase is required to install Microsoft URLScan Filter v3.1.
I have tried to remove it from the UrlRewrite settings on my website but it's not working. Can anyone please help.
Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server.
Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done for individual sites, or for the entire server (modify the properties for the Web Sites object in the tree).
For the Server header, on IIS6 you can use Microsoft's URLScan tool to remote that. Port 80 Software also makes a product called ServerMask that will take care of that, and a lot more, for you.
For IIS7 (and higher), you can use the URL Rewrite Module to rewrite the server header or blank it's value. In web.config (at a site or the server as a whole), add this content after the URL Rewrite Module has been installed:
<rewrite>
<outboundRules rewriteBeforeCache="true">
<rule name="Remove Server header">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<action type="Rewrite" value="" />
</rule>
</outboundRules>
</rewrite>
You can put a custom value into the rewrite action if you'd like. This sample sourced from this article which also has other great information.
For the MVC header, in Global.asax:
MvcHandler.DisableMvcResponseHeader = true;
Edited 11-12-2019 to update the IIS7 info since the TechNet blog link was no longer valid.
The problem is, you need to install the IIS feature Application Initialization. Then it should work with your configuration.
The image is from Rick Strahl's blog:
Also remember to set:
You can set this settings without the Application Initialization Module be installed, but then they won't have any effect.
More Information here.
Best Answer
Switch over to use the URL Rewrite v2 module instead and create a rewrite rule. This module is compatible with IIS 8.5. The downside is that it's only capable of rewriting values, not removing entire headers, so the best you can get is to have the server response with "Server:" instead of "Server:Microsoft/IIS". To entirely strip this header, you'll need to do it on the outbound using a layer 7 device (like an iRule on an F5 BIG-IP load balancer) or wait until you can start using Windows Server 2016 (one of the few new options MS added is the ability to disable the Server header).