From 342097c156facf0b65a4aedd2e5870ac2b236743 Mon Sep 17 00:00:00 2001
From: Daniel Covington <danielc@kentcommunications.com>
Date: Tue, 18 Aug 2026 12:05:34 -0400
Subject: [PATCH] Remove headers for security

---
 public/web.config | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/public/web.config b/public/web.config
index bd6a612..ce23eee 100644
--- a/public/web.config
+++ b/public/web.config
@@ -87,6 +87,22 @@
         </rule>
       </rules>
     </rewrite>
+
+    <!-- Strip the Server response header (reveals IIS version) - IIS 10+ only -->
+    <security>
+      <requestFiltering removeServerHeader="true" />
+    </security>
+
+    <!-- Strip framework-identifying headers that IIS/ASP.NET modules may add -->
+    <httpProtocol>
+      <customHeaders>
+        <remove name="X-Powered-By" />
+        <remove name="X-AspNet-Version" />
+        <remove name="X-AspNetMvc-Version" />
+        <!-- URL Rewrite module adds this in IIS Express, leaking the physical file path -->
+        <remove name="X-SourceFiles" />
+      </customHeaders>
+    </httpProtocol>
   </system.webServer>
 
 </configuration>