Security check
Server signature
Looks at the Server response header for a version number, and for any X-Powered-By header.
- Category
- Security
- Importance
- Low importance
- Check id
- server-signature
How the result is decided
- PassNo version numbers revealed.
- Warning
Servercontains a version (likenginx/1.18.0) or anX-Powered-Byheader is sent.
Why it matters
Version details make it easier to find known vulnerabilities for your exact software.
How to fix it
- Nginx:
server_tokens off; - Apache:
ServerTokens ProdandServerSignature Off - PHP:
expose_php = Offin php.ini removes X-Powered-By. Frameworks such as Express have their own switch.
After the fix, open the page’s report and choose Run again to confirm it passes.