webzod
account

Remove the version from X-Powered-By

headers.disclosure.powered_by_version · effort: minutes

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

  1. Turn the header off where it is created: PHP expose_php = Off in php.ini (then restart PHP-FPM or the web server); Express app.disable('x-powered-by'); ASP.NET on IIS, remove X-Powered-By under httpProtocol customHeaders in web.config.
  2. Or strip it at the proxy or CDN in front (see the other tabs).
php.ini 
; php.ini
expose_php = Off

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.