Remove “Server” header from ASP.NET Core 2.1 application

This solution works on IIS 10+ version and allows to remove x-powered-by and server headers in server response.

In IIS 10 a new attribute was added: removeServerHeader.

We need to create web.config file in core application with following content:

<?xml version="1.0" encoding="utf-8"?>
      <requestFiltering removeServerHeader="true" />
        <remove name="X-Powered-By" />

Then publish app and restart site on IIS.

Leave a Comment