How to hide server and framework versions
Security1 min readFixes 2 checks server-header-leak, x-powered-by-leak
Server and X-Powered-By headers that name a version tell attackers exactly which exploits to try. Remove or blank them.
Step by step, with screenshots: Rate limiting and bots on a small site, without blocking Google →
Check your own site
Runs these 2 checks and the other 185, free, in about 45 seconds.
What a passing site looks like
- Server header does not reveal a versionwarning · −1 ptseffort S
- No X-Powered-By header is sentwarning · −1 ptseffort S
1. Server header reveals the software version
Why it matters. A version string such as Apache/2.4.29 tells automated scanners exactly which known vulnerabilities to try. Hiding it costs nothing and breaks nothing.
How to fix it.
- Apache: ServerTokens Prod; nginx: server_tokens off; IIS: remove the header in web.config.
- Behind Cloudflare or a load balancer, strip the header there.
2. X-Powered-By header reveals the runtime
Why it matters. X-Powered-By names the language and often its exact version to anyone who asks. Together with the Server header it is a ready-made target list.
How to fix it.
- PHP: expose_php = Off in php.ini; Express: app.disable("x-powered-by"); ASP.NET: remove the header in web.config.