webzod
account

Remove framework version headers on Apache

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

  1. Remove the headers in both response tables (mod_headers) and reload Apache.
apache 
Header unset X-AspNet-Version
Header always unset X-AspNet-Version
Header unset X-AspNetMvc-Version
Header always unset X-AspNetMvc-Version
Header unset X-Generator
Header always unset X-Generator

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.