After creating a website with IIS, the web page cannot hide the version number. Please help.

Question

web.txtThis is my web.config file, which contains a common method to hide IIS, but it didn't work after I used it. Below is my IIS version number.Asking the expert to provide a solution
<requestFiltering removeServerHeader="true">

			<requestLimits maxAllowedContentLength="104857600"/>

		</requestFiltering>  
```![User's image](/api/attachments/75305156-dd3f-4609-9a62-6f2b77c355f5?platform=QnA)

Answer 1

Hi @浩铨 林,

Thanks for sharing your details!

I checked it, and here’s the simple reason the IIS version is still showing:

Even though you told IIS to hide the “Server” header, your app is running in “in‑process” mode, so ASP.NET Core adds its own Server header. IIS cannot remove that one.

Reference: In-process hosting with IIS and ASP.NET Core

I would recommend you try these steps out:

1. Keep your current setting removeServerHeader="true" is correct for IIS 10.0. It hides IIS’s own Server header. Reference: Request Filtering <requestFiltering>
2. Turn off the Server header inside ASP.NET Core Add this line in your Program.cs:

      builder.WebHost.ConfigureKestrel(o => o.AddServerHeader = false);
   

   This stops Kestrel (ASP.NET Core) from adding its Server header.

Note: You can change the "/en-us/" in the reference URL into "/zh-cn/" to change language.

---

Hope this helps! If you have any questions, please feel free to comment below. I'll be happy to assist!

Answer 2

Your version of Windows Server is 1607, and, according to documentation, the removeServerHeader attribute does not work prior to version 1709.

• https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/#attributes

Is it possible to update the server?