Security Policy Errors

How to Hide Server and X-Powered-By Headers in SharePoint 2019

Maira Mehtab Sep 22, 2026 869 views

Question details

Administrators need to remove the Server and X-Powered-By HTTP response headers in SharePoint Server 2019 to pass security audits.

Product: Microsoft SharePoint Server 2019
Device & OS: not provided
Scenario: Hardening an on-premises SharePoint server by stripping identifiable HTTP response headers in IIS after a security vulnerability assessment.
Observed behavior: The SharePoint server's HTTP responses expose diagnostic headers (like 'Server' and 'X-Powered-By'), revealing backend technology stack details to potential attackers.

Before you start

Before making changes to your IIS configuration, ensure you have administrative access to the server and have taken a backup of your current IIS settings and SharePoint farm configuration.

Solution 1Recommended

Remove X-Powered-By Header via IIS Manager

Use Internet Information Services (IIS) Manager to safely remove the X-Powered-By header from all HTTP responses on your SharePoint server.

The 'X-Powered-By' header indicates that the site is running on ASP.NET. Removing this header is a standard security practice and generally does not impact SharePoint functionality.

Open IIS Manager

Log into your SharePoint Server as an administrator, press the Windows key, type 'IIS', and launch Internet Information Services (IIS) Manager.

Select the SharePoint Site

In the Connections pane on the left, expand your server node, expand 'Sites', and click on your SharePoint web application.

Open HTTP Response Headers

In the central Features View, double-click on 'HTTP Response Headers'.

Remove the Header

Select 'X-Powered-By' from the list of headers. In the Actions pane on the right, click 'Remove' to delete it.

Configuration Saved: The changes take effect immediately without requiring an IIS restart, though testing the site afterward is recommended.

Solution 2

Consult Microsoft Q&A for Server Header Modifications

Because modifying the 'Server' header requires complex URL Rewrite rules or registry edits, consult official SharePoint specialists to prevent breaking farm communications.

Free Microsoft Office alternative

Looking for a Lightweight Alternative for Document Management?

While you secure your on-premises SharePoint environment, consider WPS Office for your daily desktop and mobile document editing needs. WPS Office is a free, lightweight, and highly compatible alternative to Microsoft Office that integrates smoothly into your workflow.

1. Visit the WPS Website: Go to the official WPS Office website to access the secure download page.
2. Download and Install: Click the 'Free Download' button and run the lightweight installer on your device.
3. Start Creating: Open WPS Office to immediately start viewing, editing, and saving your important documents with perfect Microsoft format compatibility.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with incredibly low system resource consumption.Familiar user interface ensuring zero learning curve for migrating users.Built-in PDF editing, conversion, and powerful document management tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why do security assessments flag the Server and X-Powered-By headers?

These headers expose the specific software and framework versions running on your server, such as IIS 10.0 or ASP.NET. Malicious actors can use this reconnaissance data to target known vulnerabilities specific to those versions.

Can removing IIS headers break SharePoint functionality?

Removing standard diagnostic headers like 'X-Powered-By' is generally safe and won't affect functionality. However, aggressively modifying or stripping the 'Server' header using URL Rewrite rules must be thoroughly tested, as certain applications or internal farm communications might rely on standard HTTP responses.

Does SharePoint Online require manual HTTP header removal?

No. SharePoint Online is a fully managed Software-as-a-Service (SaaS) environment. Microsoft handles all backend server hardening, security configurations, and header management automatically.

Microsoft Office Security Issues