webzod
account

Remove framework version headers

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

  1. Turn the header off in the framework where it can be: ASP.NET X-AspNet-Version with httpRuntime enableVersionHeader="false" in web.config; ASP.NET MVC X-AspNetMvc-Version with MvcHandler.DisableMvcResponseHeader = true in Application_Start.
  2. For headers the framework has no switch for (X-Generator from some CMSs), strip them at the web server or CDN in front (see the other tabs).
web.config 
<!-- web.config -->
<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.