Remove framework version headers on Cloudflare

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

Create a Response Header Transform Rule (Rules, Overview, Create rule) for this host with a Remove operation for each header the finding names (X-AspNet-Version, X-AspNetMvc-Version, X-Generator).

Read the documentation (opens in a new tab)

Reported by the Version disclosure check
Hide the server version number
Remove the version from X-Powered-By

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related