Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of which software they're dealing with and so automatic vulnerability discovery gets harder.

Are there scenarios where it is indeed useful to let all the world know that the site is running on IIS 7 and is X-Powered-By ASP.NET version 4?

share|improve this question
1  
I suspect they are added as a form of advertisement and to enable web server stats like you get from Netcraft. news.netcraft.com/archives/2012/01/03/… –  Zoredache Jun 4 '12 at 15:28
add comment

1 Answer

up vote 5 down vote accepted

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.