Safety. How to hide some headers (http headers) in requests

By default, the web application sends some headers to the client that allow identifying server technologies and software.

In order to make it more difficult to obtain this information, you can exclude these headers. To do this, you need to register in the web.config section in the system.webserver section:

<httpprotocol>
   <customheaders>
	  <remove name="Server"></remove>
	  <remove name="X-AspNet-Version"></remove>
	  <remove name="X-AspNetMvc-Version"></remove>
	  <remove name="X-Powered-By"></remove>
    </customheaders>
</httpprotocol>

In the Core version, you also need to add to the web.config section system.webServer/rewrite:

<outboundrules>
	<rule name="remove_server_header">
	   <match servervariable="RESPONSE_SERVER" pattern=".+"></match>
	   <action type="Rewrite"></action>
	</rule>
</outboundrules>