EngineeringScore
Security Small

Stop exposing server software versions

Response headers like Server and X-Powered-By often reveal the exact web server, framework, or language version in use. That information is not directly exploitable on its own, but it is the first thing an attacker looks up to find publicly known vulnerabilities for that specific version, turning a general scan into a targeted attack.

Why it matters

Advertising exact server or framework versions gives attackers a shortcut to find and exploit known vulnerabilities for that specific version, without any extra reconnaissance.

How to fix

  1. 1 Disable or strip the Server and X-Powered-By headers at the web server/framework config level.
  2. 2 Keep the underlying software patched regardless of whether the header is hidden.

Common mistakes

  • Hiding the header but leaving the actual software unpatched: obscurity is not a substitute for staying up to date.
  • Stripping the header at the CDN/proxy layer only, so it still leaks if a request ever reaches the origin server directly.
  • Forgetting that framework-specific headers (like X-Powered-By: Express or X-AspNet-Version) leak the same information through a different header name.

How to verify

  1. 1 Inspect the response headers and confirm Server and X-Powered-By either are absent or contain no version numbers.
  2. 2 Check both the CDN-facing and origin-facing responses if the CDN can be bypassed by requesting the origin IP directly.
  3. 3 Confirm the underlying software is still patched to a current version, independent of whether the header is hidden.

Related checks

Security X Content Type OptionsSecurity CSP

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site