How to Stop Leaking Server Info in HTTP Headers

A handful of response headers exist purely to tell the world what software and version your server is running. None of that is required for the page to work - it's free reconnaissance handed to anyone probing your site.

The Headers That Leak the Most

Server - often reveals the exact web server software and version (nginx/1.18.0, Apache/2.4.41). A version number is a direct lookup key into public CVE databases .
X-Powered-By - commonly leaks the backend framework (Express, PHP/8.1.2, ASP.NET).
X-Generator - reveals the CMS or site generator in use, narrowing down which known plugin/theme vulnerabilities are worth trying.
X-AspNet-Version / X-AspNetMvc-Version - .NET-specific headers exposing the exact framework version.

How to Fix It

Nginx

nginx.confSuppress version info in the Server header

server_tokens off;

Apache

httpd.confReduce Server header to just the product name, no version

ServerTokens Prod
ServerSignature Off

Express (Node.js)

server.tsDisable the X-Powered-By header entirely

app.disable("x-powered-by");

ASP.NET

Web.configRemove version headers

<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

CMS/generator headers

For X-Generator and similar CMS-specific headers, check your platform's documentation - most popular CMSs (WordPress, Drupal) have a plugin or one-line config change to suppress it.

How Scanverra Detects This

Scanverra's security scan reads every response header your server sends and flags Server, X-Powered-By, X-Generator, and .NET version headers individually - with higher severity when an actual version number is present versus just a software name.

Preguntas frecuentes

It's a supporting measure, not a substitute for patching - you should absolutely still keep software up to date. But there's no upside to advertising the exact version to every visitor either; it costs an attacker nothing to check, and gives them a head start on which known CVEs to try first.

No - Server, X-Powered-By, and X-Generator headers exist purely as informational metadata. No browser or client behavior depends on them, so removing or suppressing them has zero functional downside.

It's related but more severe - a stack trace or debug page doesn't just reveal a version number, it can reveal file paths, database queries, environment variables, or internal architecture. Same fix category (don't expose internals to end users), higher stakes.

Open your browser's network tab on any page load and check the response headers, or run a security scan - most frameworks (Express, ASP.NET, PHP) add this by default and most have a one-line configuration option to disable it.

Check this on your own site

Run a free scan and see exactly where you stand - no sign-up required.

Ejecutar auditoría gratis