Server version disclosure in headers

Response headers that publish exact software versions. They tell whoever is looking which known vulnerabilities to try first, and cost nothing to switch off.

• Help center

Many servers announce themselves in their response headers: Server: Apache/2.4.41 (Ubuntu), X-Powered-By: PHP/7.4.3. The exact version number helps nobody visiting your site, but it is the first thing automated attack tools read: a version maps directly to a list of known vulnerabilities, and a site running an old one is picked for exactly those exploits. Hiding the version does not fix anything, but it removes a free hint and makes you a less obvious target.

How SiteScan checks it

The scanner reads four headers of the home page — Server, X-Powered-By, X-AspNet-Version and X-Generator — and flags those that contain a version number. Product names alone, such as Server: nginx, are fine. If any version is found, the row lists the values and is amber; otherwise it says “None”.

How to switch them off

• nginx: server_tokens off;
• Apache: ServerTokens Prod and ServerSignature Off
• PHP: expose_php = Off in php.ini
• ASP.NET: <httpRuntime enableVersionHeader="false" /> in web.config, and remove X-Powered-By in IIS
• CMS generator tags: a plugin or a theme setting usually removes them.

The most important step, though, is still to keep the software updated. See also the Exposure group.