title: Best way to remove HTTP response headers in ASP.NET that reveal technology stack
body: <p>I need to remove the following headers from my ASP.NET MVC 3 web app.</p>
  <pre><code>Server
  X-AspNet-Version
  X-AspNetMvc-Version
  X-AspNetWebPages-Version
  X-Powered-By
  </code></pre>
  <p>I found two options that work. Option 1 is cleaner and actually removes the server header, but I'm trying to find out if there are any side effects I should be worried about. <strong>Is either option better than the other? What are the pros/cons of each method?</strong></p>
  <h1>Option 1</h1>
  <p>Global.asax.cs &gt;&gt; Application_Start()</p>
  <pre><code>PreSendRequestHeaders += Application_PreSendRequestHeaders;
  </code></pre>
  <p>Global.asax.cs</p>
  <pre><code>protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
  {
      HttpContext.Current.Response.Headers.Remove(&quot;Server&quot;);
      HttpContext.Current.Response.Headers.Remove(&quot;X-AspNetWebPages-Version&quot;);
      HttpContext.Current.Response.Headers.Remove(&quot;X-AspNet-Version&quot;);
      HttpContext.Current.Response.Headers.Remove(&quot;X-Powered-By&quot;);
      HttpContext.Current.Response.Headers.Remove(&quot;X-AspNetMvc-Version&quot;);
  }
  </code></pre>
  <h1>Option 2</h1>
  <p>Web.config &gt;&gt; inside <code>&lt;system.web&gt;</code> node (removes X-AspNet-Version)</p>
  <pre><code>&lt;httpRuntime enableVersionHeader=&quot;false&quot; /&gt;
  </code></pre>
  <p>Web.config &gt;&gt; inside <code>&lt;system.webServer&gt;</code> node (removes X-Powered-By)</p>
  <pre><code>&lt;httpProtocol&gt;
    &lt;customHeaders&gt;
      &lt;remove name=&quot;X-Powered-By&quot; /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  <p>Web.config &gt;&gt; inside <code>&lt;system.webServer&gt;</code> node (changes value of Server, URLRewrite required)</p>
  <pre><code>&lt;rewrite&gt;
    &lt;outboundRules rewriteBeforeCache=&quot;true&quot;&gt;
      &lt;rule name=&quot;Remove Server header&quot;&gt;
        &lt;match serverVariable=&quot;RESPONSE_Server&quot; pattern=&quot;.+&quot; /&gt;
        &lt;action type=&quot;Rewrite&quot; value=&quot;&quot; /&gt;
      &lt;/rule&gt;
    &lt;/outboundRules&gt;
  &lt;/rewrite&gt;
  </code></pre>
  <p>Global.asax.cs &gt;&gt; Application_Start() (removes X-AspNetMvc-Version and X-AspNetWebPages-Version)</p>
  <pre><code>MvcHandler.DisableMvcResponseHeader = true;
  WebPageHttpHandler.DisableWebPagesResponseHeader = true;
  </code></pre>