# How to hide server and framework versions

> Server and X-Powered-By headers that name a version tell attackers exactly which exploits to try. Remove or blank them.

Security · HTML version: https://getreport.app/learn/version-disclosure

## Server version in headers

Passing looks like: Server header does not reveal a version.

**Why it matters.** A version string such as Apache/2.4.29 tells automated scanners exactly which known vulnerabilities to try. Hiding it costs nothing and breaks nothing.

**How to fix it.**

1. Apache: ServerTokens Prod; nginx: server_tokens off; IIS: remove the header in web.config.
2. Behind Cloudflare or a load balancer, strip the header there.

## X-Powered-By header

Passing looks like: No X-Powered-By header is sent.

**Why it matters.** X-Powered-By names the language and often its exact version to anyone who asks. Together with the Server header it is a ready-made target list.

**How to fix it.**

1. PHP: expose_php = Off in php.ini; Express: app.disable("x-powered-by"); ASP.NET: remove the header in web.config.

Check your own page: https://getreport.app/