Remove framework version headers on Caddy

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

Remove the headers in the site block and reload.

Caddyfile

header -X-Generator
header -X-AspNet-Version
header -X-AspNetMvc-Version

Read the documentation (opens in a new tab)

Reported by the Version disclosure check
Hide the server version number
Remove the version from X-Powered-By

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related