Remove framework version headers on Apache

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

Remove the headers in both response tables (mod_headers) and reload Apache.

apache

Header unset X-AspNet-Version
Header always unset X-AspNet-Version
Header unset X-AspNetMvc-Version
Header always unset X-AspNetMvc-Version
Header unset X-Generator
Header always unset X-Generator

Read the documentation (opens in a new tab)

Reported by the Version disclosure check
Hide the server version number
Remove the version from X-Powered-By

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related