Remove server header from IIS 8.5

Question

I have IIS 8.5 installed on my Windows server 2012 R2. I am trying to remove the Server: Microsoft-IIS/8.5 header from my responses.

I tried installed URLScan but it fails to install with the following error

IIS Metabase is required to install Microsoft URLScan Filter v3.1.

I have tried to remove it from the UrlRewrite settings on my website but it's not working. Can anyone please help.

score 3 · Answer 1 · answered Jul 10 '16 at 02:43

Switch over to use the URL Rewrite v2 module instead and create a rewrite rule. This module is compatible with IIS 8.5. The downside is that it's only capable of rewriting values, not removing entire headers, so the best you can get is to have the server response with "Server:" instead of "Server:Microsoft/IIS". To entirely strip this header, you'll need to do it on the outbound using a layer 7 device (like an iRule on an F5 BIG-IP load balancer) or wait until you can start using Windows Server 2016 (one of the few new options MS added is the ability to disable the Server header).

score 0 · Answer 2 · answered May 13 '16 at 13:01

0

You probably don't have the IIS 6 Metabase Compatibility installed.

You can find some more information about installing URLScan here. Hope this helps.

answered May 13 '16 at 13:01

Cerveser

234
1
7

score 0 · Answer 3 · edited May 23 '17 at 12:41

Just use clear tag in custom headers segment in web.config:

<system.webServer>
   <httpProtocol>
      <customHeaders>
           <clear />
      </customHeaders>
   </httpProtocol>
</system.webServer>

Also you can add any custom header or some of default IIS headers below "clear" tag. See same question and answer in stackoverflow:

https://stackoverflow.com/questions/22401219/remove-server-response-header-iis-8-0-8-5/39472251#39472251

Remove server header from IIS 8.5

3 Answers3