Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following:


I've installed a signed one into the GAC and also tried the App_Code directory and neither has worked. I've also tried setting the


registry entry to 1 and still nothing.

EDIT: I've also tried this: Community ISAPI filter

Is there any possible way to do this?


I've tried adding the following to my application-level "Web.Config" file with varying degrees of success:

        <remove name="ETag" />
        <remove name="Server" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
        <remove name="X-Powered-By" />

This only applies to content served out of the application directory (and subdirectories) and doesn't work when applied to the "applicationHost.config" file underneath the "System32/inetsrv/config" directory. I've also had this change not work at all (how I came across your question here while researching this issue), so your mileage may vary.

  • Doesn't remove the Server header – jjxtra May 18 '12 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.