How to hide server and framework versions
Server and X-Powered-By headers that name a version tell attackers exactly which exploits to try. Remove or blank them.
Step by step, with screenshots: Server and X-Powered-By headers: why version numbers matter →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free Tech stack & CMS detector or the free Security headers checker.
What it is
Version disclosure is when your server's response headers name the software and exact version it runs, for example Server: Apache/2.4.29 (Ubuntu) or X-Powered-By: PHP/7.4.3. Anyone who requests a page, including automated scanners, can read them.
A version number lets an attacker look up the known vulnerabilities for that exact release and try only the ones that work, and old versions stand out at once. Hiding it does not fix those holes, so keep the software updated too, but it removes a free target list and costs nothing. getReport flags a Server header with a version number and any X-Powered-By header. A response is OK when Server shows at most a product name, such as nginx, and X-Powered-By is absent.
What a passing site looks like
- Server header does not reveal a versionwarning · −1 ptseffort S
- No X-Powered-By header is sentwarning · −1 ptseffort S
1. Server header reveals the software version
Why it matters. A version string such as Apache/2.4.29 tells automated scanners exactly which known vulnerabilities to try. Hiding it costs nothing and breaks nothing.
- Apache: ServerTokens Prod; nginx: server_tokens off; IIS: remove the header in web.config.
- Behind Cloudflare or a load balancer, strip the header there.
2. X-Powered-By header reveals the runtime
Why it matters. X-Powered-By names the language and often its exact version to anyone who asks. Together with the Server header it is a ready-made target list.
- PHP: expose_php = Off in php.ini; Express: app.disable("x-powered-by"); ASP.NET: remove the header in web.config.
Questions people ask
What does the X-Powered-By header reveal?
It names the technology that generated the page, such as PHP/8.1.2, ASP.NET or Express, often with the exact version. Browsers do not need it for anything; frameworks add it by default. Scanners use it to choose attacks, which is why penetration tests and security scanners report it. Removing it has no effect on how your site works.
How do I hide the X-Powered-By header?
Turn it off where it is added. For PHP, set expose_php = Off in php.ini; in Express, call app.disable("x-powered-by"); in ASP.NET, remove it in web.config. As a catch-all, Header unset X-Powered-By in Apache or proxy_hide_header X-Powered-By in nginx strips it. For the Server header, use server_tokens off in nginx or ServerTokens Prod in Apache.
Is server version disclosure a vulnerability?
On its own it is an information leak, usually rated low or informational, not a way in. It becomes a real risk when the version it reveals has known vulnerabilities, because it tells attackers exactly which exploit to try. Hide the version, then treat the finding as a reminder to check that the software itself is up to date.