Remove the "Server" and "X-Powered-By" headers

[blairlearn]

AppScans have begun requiring that the server not reveal its version number. In IIS 10, this can be addressed via the web.config

To remove the Server header, in the system.webServer section, add;

       <security>
            <requestFiltering removeServerHeader="true" />
        </security>

To remove the X-Powered-By header, in the <system.webServer> section, add:

      <httpProtocol>
        <customHeaders>
          <remove name="X-Powered-By" />
        </customHeaders>
      </httpProtocol>

ESTIMATE TBD

Prerequisites

Sub-Tasks

Notes