Remove the version from X-Powered-By on Caddy

headers.disclosure.powered_by_version · effort: minutes

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

Remove the header with the line below in the site block and reload.

Caddyfile

header -X-Powered-By

Read the documentation (opens in a new tab)

Reported by the Version disclosure check
Hide the server version number
Remove framework version headers

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related