Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

James Drew

27th June 2023

4 min read

This is the second article in our Application Security 101 mini-series. Read our first blog on how to configure HTTP response headers with security best practices.

This time we’re going to discuss another misconfiguration that we often find during website penetration testing. This is not necessarily a ‘vulnerability’, however information disclosure via HTTP response headers can provide exact version information of the web server or web technologies in use on the underlying host. With this information to hand, it may be possible to identify vulnerabilities within that software and search for any publicly disclosed exploit code, which may lead to compromise of sensitive information or full control of the underlying server.

We’ll take a look at the three web server applications we used previously; Apache, nginx and IIS, and how we can configure these to reduce the amount of information that is exposed in HTTP response headers by each of them.

Before you read on:

  • Ideally all of the suggested security best practices below should be tested, preferably in a test or development environment. If there is no ability to perform changes within separate environments, backups of the current working configurations should be made to ensure that you can revert to a working state should changes break functionality.
  • Removing version information is not a remediation for running outdated software.

Server Header Information Disclosure

The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead to information disclosure about the web server hosting an application and in some cases, the Operating System (OS). A quick example of the Server response header can be seen below, when accessing a website powered by IIS.

Server: Microsoft-IIS/10.0


This information may appear to be of low value, however Microsoft IIS versions are directly related to the Windows Operating System (OS) versions. A quick search and we can find which version is deployed with each OS.

Version Start Date End Date
IIS 10 on Windows Server 2019 Nov 13, 2018 Jan 9, 2029
IIS 10 on Windows Server (Semi-Annual Channel) Oct 17, 2017
IIS 10 on Windows Server 2016 Oct 15, 2016 Jan 12, 2027
IIS 10 on Windows 10, Enterprise and Education Jul 29, 2015
IIS 10 on Windows 10 Pro Jul 29, 2015
IIS 8.5 on Windows Server 2012 R2 Nov 25, 2013 Oct 10, 2023
IIS 8.5 on Windows 8.1 Nov 13, 2013 Jan 10, 2023
IIS 8 on Windows Server 2012 Oct 30, 2012 Oct 10, 2023
IIS 7.5 on Windows 7* Oct 22, 2009 Jan 14, 2020
IIS 7.5 on Windows Server 2008 R2* Oct 22, 2009 Jan 14, 2020
IIS 7.0 on Windows Server 2008* May 6, 2008 Jan 14, 2020
IIS 6.0 on Windows Server 2003 May 28, 2003 Jul 14, 2015


With this information, it’s possible to glean the version of underlying OS. This gives a potential attacker information to search for any publicly available exploits aimed at compromising the specific OS version (or indeed the web server itself). As we can see, disclosing the version of IIS for older OS’s such as IIS 6.0 on Windows Server 2003 may pose a significant threat to your environment. Thankfully we don’t see this version too often these days.

Now that we’ve seen an example of this information disclosure, we’ll look at solutions for removing this information from HTTP response headers.

Internet Information Services (IIS)

Starting with IIS 10, it is possible to remove the Server header completely using the IIS Manager. To do so, follow the steps below.

  • Open IIS Manager
  • Choose “Configuration Editor”
  • Open Section “system.WebServer > Security > requestFiltering”
  • Change “removeServerHeader” to True (as below)
  • Under Actions, click “Apply”

Note: You may need to enable request filtering within Programs and Features first. Once enabled, you should then be able to complete the steps above.

If you have any issues and find that the Server response header still remains, check that the IIS Manager is running with Administrator privileges before making changes. In addition to this, you can check the contents of the web.config file in the web root. Ensure that the ‘requestFiltering removeServerHeader’ node is set to “true” as shown below.

<requestFiltering removeServerHeader="true" />


In Windows systems, an additional header that can disclose version information is the ‘x-aspnet-version’ header. This can also be removed in the IIS Manager as follows.

  • Open IIS Manager
  • Choose “Configuration Editor”
  • Open section “system.web > httpRuntime”
  • Change “enableVersionHeader” to False
  • Click Apply under Actions

Again, you can review the contents of the web.config file to confirm that the setting has been applied, as shown below.

<httpRuntime enableVersionHeader="false" />


After applying the above, the IIS Server response header should no be present and disclose any information.

For older versions of IIS that do not support the ‘removeServerHeader’ directive by default, the URL Rewrite extension can be installed and configured to achieve the desired results.


The Apache web server is commonly used because of its ease of deployment and setup and is often deployed on Linux operating systems. All that is required to remove the server header from Apache server instances is a change to the configuration file.

The following shows an example of the information disclosed in the Server header when accessing a website hosted on Apache.

Server: Apache/2.4.51 Debian


It very clearly discloses the server technology, version number and which operating system it’s applicable for.

To strip this information from the response header, add the following lines to the Apache configuration file. In our example, we changed the /etc/apache2/apache2.conf file, however yours may be in a different location depending on your platform and configuration.

ServerTokens Prod
ServerSignature Off


After saving the configuration file, a server restart is required.

service apache2 restart


After reloading the website, the version information is no longer present in the Server response header.


Like Apache, the nginx web server reveals its version within the Server response header. The following demonstrates the information disclosure.

Server: Nginx/1.18.0


To strip this information from the response header, add the following lines to the nginx configuration file. In our example, we changed the /etc/nginx/nginx.conf file.

server_tokens off;


After saving the configuration change, a server restart is required.

service nginx restart


After reloading the website, the version information is no longer present in the Server response header.

The is not an exhaustive list of web servers, but they are the most common web server technologies we see during penetration testing. We encourage you to look at any documentation for web servers that are not included here as they are often configured similarly. It is often relatively simple to reduce information disclosure by preventing version information from showing in HTTP response headers.

We may update this article in future to include additional web servers or web frameworks, such as PHP, that can also lead to information disclosure.

Our website penetration testing services provide a deep inspection of your application security, using techniques similar to malicious actors to identify vulnerabilities. Contact us to find out more about our application security services.


  • Insights
  • Labs
ISO 9001 and ISO 27001

Sentrium Achieves ISO 9001 and ISO 27001 Certifications

In an increasingly digital world, the importance of quality and security cannot be overstated. Sentrium Security Ltd is excited to share our recent achievement –…

What are the different types of penetration testing?

What are the different types of penetration testing?

As digital business becomes more widespread, the need to ensure data security increases. One way to test its effectiveness is through penetration testing. Penetration tests…

OWASP Global Image

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

Using a CREST-Approved penetration testing provider

What is CREST penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

cloud computing technology concept transfer database to cloud. T

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…