How do I remove the IIS Server header?

On IIS 10.0 and later, set `removeServerHeader` to true in request filtering. The IIS documentation notes it does not work on Windows versions before 1709.

Does __VIEWSTATE mean the site is outdated?

It means the page uses ASP.NET Web Forms, an older programming model. That is an inventory fact, not a vulnerability on its own.

Why does my ASP.NET Core API send no HSTS header?

Default API templates do not include it, because HSTS is a browser instruction. If browsers use the API directly, add the HSTS middleware or set it at the proxy.

Technologies

ASP.NET and IIS

ASP.NET is recognisable from headers that name it — an `X-AspNet-Version` header or `X-Powered-By: ASP.NET` — and from the `__VIEWSTATE` hidden field that Web Forms pages carry. The Microsoft IIS server in front usually announces itself too, in a `Server` header that includes its version. IIS 10.0 added a documented setting to suppress that header, and ASP.NET Core documents where HTTPS redirection and HSTS are configured.

How the engine recognises it

An `X-AspNet-Version` header, or `X-Powered-By` naming ASP.NET — weight 90.

A `__VIEWSTATE` field in the markup — weight 80. It belongs to ASP.NET Web Forms, so it identifies that older programming model specifically.

A `Server: Microsoft-IIS/x.y` header is read separately and its version is listed exactly as published.

ASP.NET Core applications served by Kestrel without IIS usually send none of these, and are recognised only if a header names the stack.

Version headers

`X-AspNet-Version` publishes the ASP.NET runtime version; `Microsoft-IIS/10.0` publishes the IIS version.

Both are disclosures rather than vulnerabilities, and both are listed as observed.

IIS's request-filtering documentation states that IIS 10.0 added the `removeServerHeader` attribute to suppress the server header, with a default of false.

The attribute does not work on Windows versions older than Server 1709 or Windows 10 1709, according to the same page.

HTTPS and HSTS in ASP.NET Core

ASP.NET Core provides HTTPS redirection middleware and HSTS middleware, and HSTS is sent only when the application uses the HSTS middleware.

The documentation notes that default API project templates do not include HSTS, since it is a browser instruction other clients do not obey.

It also notes that when a reverse proxy — IIS 10.0 version 1709 or later among them — handles HTTPS and HSTS, the application does not need to.

An external audit reports the behaviour the response shows, whichever layer produced it.

Error pages

ASP.NET Core's error-handling documentation describes a developer exception page that shows detailed exception information.

For the Production environment, it describes a custom exception-handling page configured with `UseExceptionHandler`, which logs the exception and re-executes the request on an error path.

A detailed exception page on a public site is an error-disclosure finding whatever the framework.

It is visible only when an error occurs during the scan.

Which checks apply

`technology.inventory` and `technology.versions` list ASP.NET and IIS with any version published.

`security.server_disclosure` reports the version headers.

`transport.hsts` and `transport.http_redirect` report the HTTPS behaviour the response shows.

`api.errors.disclosure` reports detailed error responses when one is met.

Where X-Powered-By: ASP.NET comes from

IIS's documentation for custom headers shows the default `<httpProtocol>` configuration, which adds `X-Powered-By` with the value `ASP.NET`.

Custom response headers configured there are returned in every response, unlike redirect headers, which appear only on redirects.

The header is therefore a property of the IIS configuration rather than of the application, and it is removed with a `remove` element in the same `customHeaders` collection.

That is also why it survives application-level hardening: the application never set it.

Redirect and HSTS defaults in ASP.NET Core

The HTTPS redirection middleware sends a 307 Temporary Redirect by default; the documentation shows how to send a permanent redirect outside the Development environment.

The HSTS middleware's `max-age` defaults to 30 days when not set.

For a first HTTPS deployment, the documentation advises starting with a small `max-age` — hours up to a single day — and increasing it, commonly to one year, once HTTPS is stable.

An audit reports the redirect status and the HSTS value exactly as sent, which is where these defaults show.

Frequently asked questions

How do I remove the IIS Server header?: On IIS 10.0 and later, set `removeServerHeader` to true in request filtering. The IIS documentation notes it does not work on Windows versions before 1709.
Does __VIEWSTATE mean the site is outdated?: It means the page uses ASP.NET Web Forms, an older programming model. That is an inventory fact, not a vulnerability on its own.
Why does my ASP.NET Core API send no HSTS header?: Default API templates do not include it, because HSTS is a browser instruction. If browsers use the API directly, add the HSTS middleware or set it at the proxy.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website