0

Can anyone advise how to hide the IIS 7.5 in HTTP header?

Thanks alot for any advice and any inputs are appreciated.

Basically is to hide it from the headers.

1
  • 1
    The answer below has two good options for doing this. Note however, that it's pretty much useless. If you're thinking that someone attacking your server will use this against you, they'll just try every hack they know of - they will not limit themselves to options they think will work.
    – Chris S
    Mar 10, 2014 at 3:36

2 Answers 2

2

You can accomplish this by editing the registry.

In HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters, create a DWORD entry called DisableServerHeader and set the value to 1.

Also, you can use the URLRewrite module or install URLScan, more about this in the following article:

http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx

1

I had researched this as Registry entry mentioned above does not remove this; however, the URLRewrite method works well. Can't seem to find the change scripted anywhere well. I wrote this compatible with PowerShell v2 and above and tested it on IIS 7.5.

# Add Allowed Server Variable
    Add-WebConfiguration /system.webServer/rewrite/allowedServerVariables -atIndex 0 -value @{name="RESPONSE_SERVER"}
# Rule Name
    $ruleName = "Remove Server Response Header"
# Add outbound IIS Rewrite Rule
    Add-WebConfigurationProperty -pspath "iis:\" -filter "system.webServer/rewrite/outboundrules" -name "." -value @{name=$ruleName; stopProcessing='False'}
#Set Properties of newly created outbound rule 
    Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST"  -filter "system.webServer/rewrite/outboundRules/rule[@name='$ruleName']/match" -name "serverVariable" -value "RESPONSE_SERVER"
    Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST"  -filter "system.webServer/rewrite/outboundRules/rule[@name='$ruleName']/match" -name "pattern" -value ".*"
    Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST"  -filter "system.webServer/rewrite/outboundRules/rule[@name='$ruleName']/action" -name "type" -value "Rewrite"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .