Remove headers for security

public/web.config

@@ -87,6 +87,22 @@
         </rule>
       </rules>
     </rewrite>
+
+    <!-- Strip the Server response header (reveals IIS version) - IIS 10+ only -->
+    <security>
+      <requestFiltering removeServerHeader="true" />
+    </security>
+
+    <!-- Strip framework-identifying headers that IIS/ASP.NET modules may add -->
+    <httpProtocol>
+      <customHeaders>
+        <remove name="X-Powered-By" />
+        <remove name="X-AspNet-Version" />
+        <remove name="X-AspNetMvc-Version" />
+        <!-- URL Rewrite module adds this in IIS Express, leaking the physical file path -->
+        <remove name="X-SourceFiles" />
+      </customHeaders>
+    </httpProtocol>
   </system.webServer>
 
 </configuration>