Techie BabajiLearn to Code. Build Real Skills.
IIS (Internet Information Services) · Security

HTTP Response Headers

Response headers tell browsers how to treat your site. A few headers block whole classes of attacks.

Intermediate 5 min Lesson 20 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:HTTPS and SSL Certificates
0/33 in IIS
On this page · 5 min · Intermediate

On this page

  1. In simple words
  2. Learning objectives
  3. Explanation
  4. Code example
  5. Step by step
  6. Real-world use
  7. Common mistakes
  8. Best practices
  9. Remember this
  10. Practice exercise
  11. Mini quiz
  12. Related topics
  13. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 30, 2026

Related tutorials

Interview questions

In simple words#

Response headers are instructions printed on a parcel: “fragile”, “keep upright”, “open only with the receiver present”. Browsers follow them when handling your pages.

HSTS
Always use HTTPS for this site.
X-Content-Type-Options: nosniff
Don’t guess file types.
X-Powered-By
Reveals technology — remove it.

Learning objectives#

  • Add security headers
  • Remove technology-revealing headers
  • Set headers per path
  • Verify headers with browser tools or curl

Explanation#

Add headers in HTTP Response Headers (IIS Manager) or <customHeaders> in web.config.

Useful security headers: Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy, X-Frame-Options or CSP frame-ancestors, Content-Security-Policy.

Remove X-Powered-By (added by ASP.NET) and the Server header (requestFiltering removeServerHeader="true" in IIS 10).

ASP.NET Core can also set headers in middleware; choose one place to avoid duplicates.

Code example: Security headers#

XMLweb.config Illustrative
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
      <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
      <add name="X-Content-Type-Options" value="nosniff" />
      <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
      <add name="X-Frame-Options" value="SAMEORIGIN" />
      <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=()" />
    </customHeaders>
  </httpProtocol>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
</system.webServer>


<!-- Check:  curl -I https://shop.example.com  -->
Expected output
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
(no Server or X-Powered-By header)

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. X-Powered-By is removed.
  2. HSTS forces HTTPS for a year.
  3. nosniff, Referrer-Policy and X-Frame-Options add protection.
  4. removeServerHeader hides the IIS version.

Real-world use case#

A security scan flags missing headers; adding these five lines to web.config clears the findings.

Common mistakes#

HSTS before HTTPS works everywhere

Browsers will refuse HTTP for a year. Make sure every subdomain supports HTTPS first.

Setting the same header in IIS and the app

Duplicate headers can confuse browsers. Pick one place.

Best practices#

  • Add core security headers to every site
  • Remove technology fingerprints
  • Test with curl -I
  • Build a CSP gradually (report-only first)

Remember this#

customHeaders adds; remove deletes.

HSTS + nosniff + Referrer-Policy as a baseline.

Hide Server and X-Powered-By.

Practice exercise#

Your task: Add a Content-Security-Policy in report-only mode.

Show solution
XML Illustrative
<add name="Content-Security-Policy-Report-Only" value="default-src 'self'; img-src 'self' data:" />

Mini quiz#

HTTP Response Headers quizMultiple choice Question 1 of 1

Which header tells browsers to always use HTTPS?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.