webzod
account

Remove framework version headers on nginx

headers.disclosure.framework_version · effort: minutes

Why it matters

Headers such as X-AspNet-Version, X-AspNetMvc-Version and X-Generator name the exact framework release, which tells attackers which known vulnerabilities to try. Browsers never need them.

The fix

  1. Hide the headers from the backend in the http or server block, run sudo nginx -t and reload. Use proxy_hide_header for proxied applications and fastcgi_hide_header for PHP-FPM.
  2. A location with proxy_hide_header or fastcgi_hide_header lines of its own does not inherit the server-level ones, so repeat these lines there.
nginx 
proxy_hide_header X-AspNet-Version;
proxy_hide_header X-AspNetMvc-Version;
fastcgi_hide_header X-Generator;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.