Technical Tip: How to delete HTTP headers with server information

[faical]

Description	The article explains how to delete any details pointing to a web server name and type.
Scope	FortiWeb.
Solution	FortiWeb can be configured to remove an HTTP header by using a URL Rewriting Policy. In most cases, details about the server end are set on the headers like 'Server' and 'X-Powered-By' which can be configured on the URL Rewriting Rule as shown below: The filter of the URL Rewriting Policy/Rule can be the HTTP Host (in this example Server IP, but in general a domain name can be used depending on how Web Server is accessed). Notes: URL Rewriting Policy/Rule should be applied to the Policy/Web Protection Profile. 'Remove Duplicate Headers' to be enabled as some Web Servers return multiple 'X-Powered-By' headers. Related document: Rewriting & redirecting