Each page in an MVC application I\'m working with sets these HTTP headers in responses:
X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 X-AspNetMvc-Version
The X-Powered-By header is added by IIS to the HTTP response, so you can remove it even on server level via IIS Manager:
You can use the web.config directly: