Global.asax.cs

public class WebApiApplication : System.Web.HttpApplication {

    protected void Application_Start() {
    
        //...

        GlobalConfiguration.Configuration.MessageHandlers.Add(new RemoveServerHeaderMessageHandler());
    }
}

RemoveServerHeaderMessageHandler.cs

public class RemoveServerHeaderMessageHandler : DelegatingHandler {

    protected override System.Threading.Tasks.Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) {

        return base.SendAsync(request, cancellationToken).ContinueWith(task => {

            var response = task.Result;

            var httpContext = response.RequestMessage.Properties["MS_HttpContext"] as HttpContextWrapper;
            if (httpContext != null)
                httpContext.Response.Headers.Remove("Server");

            return response;
        });
    }
}