webzod
account

Hide the server version number on Caddy

headers.disclosure.server_version · effort: minutes

Why it matters

A version number in the Server header tells attackers exactly which known vulnerabilities to try, without any probing. Hiding it fixes nothing by itself, so keep the software updated as well.

The fix

  1. Caddy's own Server header has no version, so the version comes from the application behind reverse_proxy. Remove the header with the line below and reload.
Caddyfile 
header -Server

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.