Remove IIS 10 Server Header which discloses IIS version

📁 Configuration Path

• Folder: C:\Windows\System32\inetsrv\Config

• File: applicationHost.config

⚙️ Add Outbound Rule to Remove Server Header

Insert the following XML snippet inside the <system.webServer> section of applicationHost.config:

<outboundRules>
  <rule name="Remove Server header">
    <match serverVariable="RESPONSE_Server" pattern=".+" />
    <action type="Rewrite" value="" />
  </rule>
</outboundRules>

🛑 Make sure to back up the configuration file before making changes. This rule suppresses the Server header from HTTP responses, helping reduce server fingerprinting.