Network Management

Disable the IIS web banner and other IIS headers in the Orion Platform

This article contains some helpful steps on how to harden your IIS Server by disabling the header and banner in IIS 10.0. This avoids the display of minor information leaks in HTTP response headers.

First published date

5/14/2019 11:34 AM

Last published date

1/31/2025 12:55 PM

Overview

This article details how to configure the Internet Information Services (IIS) for Windows Server to prevent the display of minor information leaks in HTTP response headers. In some cases, a server banner may display information about the underlying hosting environment.

Some of the information that can be exposed are:

Server: The web server version.
X-Powered-By: Indicates the website is "Powered by ASP.Net".
X-AspNet-Version: Indicates the version of ASP.NET used by the website.

Product section

Network Performance Monitor

Cause

The HTTP Header "X-ASPNET-VERSION" reveals the version of ASP.NET being used by the web.config file.

Resolution

Remove the "X-Powered-By" header

Open the IIS Manager.
Select the Orion website.
Select "HTTP Response Headers"
Select the "X-Powered-By" HTTP Header and select "Remove".
Disable the HTTP header "X-POWERED-BY":
1. Open the web.config file located in the root directory for the Orion website.
2. Just after the <system.web> tag add:
```
<httpRuntime enableVersionHeader="false" />
```
3. Save the file.
Restart the Orion Module Engine.

Remove the "X-AspNet-Version" header

Open the IIS Manager.
Select the Orion website.
Select "HTTP Response Headers"
Select the "X-AspNet-Version" HTTP header and select "Remove".
Disable the HTTP header "X-ASPNET-VERSION":
1. Open the web.config file located in the root directory for the Orion website.
2. Just after the <system.web> tag add:
```
<httpRuntime enableVersionHeader="false" />
```
3. Save the file.
Restart the Orion Module Engine.

Remove the remote Server header

These directions apply to IIS 10.0 only.

Open the web.config file located in the root directory for the Orion website.

Configure requestFiltering in the web.config system.webServer node:

<security>
<requestFiltering removeServerHeader ="true" />
</security>

Save the file.

For additional directions on updating your IIS configuration settings to remove information from the HTTP response headers, see the following article from the Microsoft IIS Support Blog:

Remove Unwanted HTTP Response Headers (© 2019 Microsoft, available at https://techcommunity.microsoft.com/ , obtained on November 27, 2019)

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.