Security Headers Checker / Headers
Server and X-Powered-By: stop announcing software versions
Headers such as Server: nginx/1.18.0 or X-Powered-By: PHP/7.4 tell an attacker exactly which known vulnerabilities to try. Removing the version is cheap; it does not replace updating the software.
What to do
Hide the version (server_tokens off, ServerTokens Prod, expose_php = Off) and remove X-Powered-By. Our fixes show how on 32 platforms.
How our grade counts it
- Effectiveness, minus 5: Version leakage (Server version, X-Powered-By, X-AspNet-Version)
Common mistakes
- Hiding the version but never updating: the version is still easy to guess from behaviour.
Check your site
The checker reads Server and X-Powered-By the way a browser applies it, alongside every other security header.
Open the Security Headers Checker