Remove Server Response Header IIS 8.0 / 8.5

Question

How can we remove the server header response in IIS 8.0/8.5?
My current server report: Microsoft-IIS/8.0 Microsoft-IIS/8.5
For IIS 7.0 I used the URLScan 3.1 however this is only supported for IIS 7.0 and not 8.x

Answer 1

Unfortunately most of the recommendations you will find online for removing the "Server" header in IIS will not work for IIS 8.0 and 8.5. I have found the only working option, and in my opinion, also the best, is to use an IIS Native-Code module.

Native-Code modules differ from the more common Managed modules, as they are written using the win32 APIs rather than ASP.NET. This means that they work for all requests (including static pages and images) rather than just requests that past though the ASP.NET pipeline. Using a Native-Code module, it is possible to remove unwanted headers at the very end of the request, meaning that you can remove headers (including the "Server" header) regardless of where they have been set.

Binaries and source code of an example Native-Code module for removing headers in IIS 7.0 to 8.5 are available in the following article.

http://www.dionach.com/blog/easily-remove-unwanted-http-headers-in-iis-70-to-85

Answer 2

It is possible now to remove Server header from web.config starting from IIS 10.0 :

<security>
  <requestFiltering removeServerHeader ="true" />
</security>

More details on how to remove all unwanted/unnecessary headers can be found here.

Please note that this hides server header from the "application", as do all the other approaches. If you e.g. reach some default page or an error page generated by the IIS itself or ASP.NET outside your application these rules won't apply. So ideally they should be on the root level in IIS and that sill may leave some error responses to the IIS itself.

There is a bug in IIS 10 that makes it sometimes show the header even with config. It should be fixed by now, but IIS/Windows has to be updated.