title: Remove "Server" header from ASP.NET Core 2.1 application
body: <p>Is it possible to remove the <strong>Server</strong> Response header in a ASP.NET Core 2.1 application (running on Server 2016 with IIS 10)?</p>
  
  <p>I tried putting the following in the web.config:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
      &lt;httpProtocol&gt;
          &lt;customHeaders&gt;
              &lt;add name="X-Frame-Options" value="sameorigin" /&gt;
              &lt;add name="X-XSS-Protection" value="1; mode=block" /&gt;
              &lt;add name="X-Content-Type-Options" value="nosniff" /&gt;
              &lt;remove name="X-Powered-By" /&gt;
              &lt;remove name="Server" /&gt;
          &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>The first four alterations to the Response worked fine, but the <strong>Server</strong> header was not removed.  I still see "Kestrel"</p>