Hide server and framework versions

Disclosure · about 15 min

In plain words

Headers like "Server: nginx/1.18.0" or "X-Powered-By: PHP/7.4" tell attackers exactly which known bugs to try.

Makes it trivial to match your site to published exploits for that version.

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

# http { } block
server_tokens off;

# httpd.conf / apache2.conf
ServerTokens Prod
ServerSignature Off

# .htaccess
Header unset X-Powered-By

; php.ini
expose_php = Off

app.disable('x-powered-by');

Rules → Transform Rules → Modify Response Header
  Remove: X-Powered-By

Before you change anything: Hiding versions is not a fix by itself — also keep the software updated.

Re-run the ProbeHunt check.