Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of which software they're dealing with and so automatic vulnerability discovery gets harder.

Are there scenarios where it is indeed useful to let all the world know that the site is running on IIS 7 and is X-Powered-By ASP.NET version 4?

share|improve this question
I suspect they are added as a form of advertisement and to enable web server stats like you get from Netcraft.… – Zoredache Jun 4 '12 at 15:28
up vote 14 down vote accepted

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.