Support Library
Server Version Disclosure in HTTP Headers
Many web servers announce themselves in every response, for example Server: Apache/2.4.49 (Unix) or X-Powered-By: PHP/7.4.3. An exact version number tells anyone scanning the internet which known vulnerabilities to try first.
The short answer
Turn off version details in the Server header, remove X-Powered-By and similar headers, and, more importantly, keep the software patched. Hiding the version slows automated attacks; it does not fix a vulnerable version.
How attackers use it
How DNS Panopticon detects it
Security Posture reads the Server and X-Powered-By headers on your homepage and flags them when they contain a version number. The result appears on the Website Application Security card.
| Finding | Severity | When it appears |
|---|---|---|
| Server software versions are shown | Low | Server or X-Powered-By includes a version, such as nginx/1.18.0, Microsoft-IIS/8.5 or PHP/7.4.3. The finding lists what was seen. |
The same versions feed the Vulnerability Management card, which checks them against known CVEs and end-of-life dates. If that card flags a version, updating it matters far more than hiding it.
How to check it yourself
| Command | What to look for |
|---|---|
| curl -sI https://example.com | server, x-powered-by, x-aspnet-version, x-aspnetmvc-version and x-generator lines with version numbers. |
| curl -sI https://example.com/does-not-exist | Error pages, which sometimes show more than normal pages. |
Also look at the bottom of your default error pages; Apache and Tomcat print the version there unless told not to. Page HTML can reveal versions too, for example a <meta name="generator" content="WordPress 6.x"> tag.
Why it matters
- Faster targeting. When a new exploit is published, attackers search banner indexes for every server running the affected version. A version in your header puts you on that list.
- Reveals neglect. An old version number tells attackers the site is probably not patched in general.
- Cheap to remove. It is a one-line setting on most platforms.
This finding is rated low on purpose. Determined attackers can often fingerprint software without the header, and a patched server with a visible version is safer than an unpatched one that hides it.
How to fix it
| Software | Setting |
|---|---|
| nginx | server_tokens off; in the http block (shows “nginx” without a version) |
| Apache | ServerTokens Prod and ServerSignature Off (shows “Apache” only) |
| PHP | expose_php = Off in php.ini (removes X-Powered-By: PHP) |
| IIS 10 | <requestFiltering removeServerHeader="true" /> under system.webServer/security, and <remove name="X-Powered-By" /> under httpProtocol/customHeaders |
| ASP.NET | <httpRuntime enableVersionHeader="false" /> (removes X-AspNet-Version) |
| Express | app.disable('x-powered-by'), or use Helmet |
| Tomcat | Set server on the Connector and use an ErrorReportValve with showServerInfo="false" |
- Patch first. If the version shown is out of date or has known vulnerabilities, update it. That is the real fix.
- Remove version details with the settings above and reload the service.
- Check your CDN or proxy, which may add or pass through its own headers.
- Customise error pages so they do not print server details.
FAQ
Is hiding the version “security through obscurity”?
Partly, which is why it is only a low-severity finding. It does not fix anything, but it removes free information and keeps you off the quickest automated target lists. Patching is what actually protects you.
Can I remove the Server header entirely?
On some platforms, such as IIS 10 and many CDNs, yes. nginx and Apache show their name at minimum unless you add a module or a proxy in front. Removing the version is what matters.
Our CDN shows Server: cloudflare. Is that a problem?
No. DNS Panopticon only flags headers that include a version number, and a CDN name says nothing about the software behind it.