Add this to your global.asax.cs:
protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
// Remove the "Server" HTTP Header from response
HttpApplication app = sender as HttpApplication;
if (null != app && null != app.Request && !app.Request.IsLocal &&
null != app.Context && null != app.Context.Response)
{
NameValueCollection headers = app.Context.Response.Headers;
if (null != headers)
{
headers.Remove("Server");
}
}
}