What we check/Security headersHD-06

Server version disclosure

Announcing your exact software version tells an attacker which published exploits to try first.

Area

Security headers

Check

HD-06

Included

Free in every scan

What we check

We read Server and X-Powered-By and flag values containing a version number. A bare product name is not a disclosure.

Why it matters

This is not a vulnerability, it is a shortcut for someone looking for one. nginx/1.18.0 narrows their search from 'everything' to 'the known issues in this build'.

The cost of removing it is zero and the benefit is narrow but real: it takes your domain out of the results when someone scans the internet for a specific vulnerable version rather than testing every host individually.

How to fix it

1. 1

   Turn off version tokens in your server, and remove X-Powered-By entirely.

2. 2

   Check your application framework as well as the web server: X-Powered-By usually comes from the framework, and Server from whatever sits in front of it.

3. 3

   Check your application framework as well as the web server: X-Powered-By usually comes from the framework and Server from whatever sits in front of it.

4. 4

   Behind a CDN, verify what the public actually sees rather than what your origin sends — the two often differ.

nginx:   server_tokens off;
Apache:  ServerTokens Prod
Express: app.disable("x-powered-by")
Next.js: poweredByHeader: false

Common questions

Is this security through obscurity?

Partly, and it is not a substitute for patching. It is also free, and it removes your domain from the results of a scan for a specific vulnerable version.

Why is Server: cloudflare fine?

It names a product without a version, which tells an attacker nothing they could not see anyway.

Does hiding the version mean I can delay updates?

No. It buys nothing against anyone who simply tries the exploit.