How to Stop Leaking Server Info in HTTP Headers

A handful of response headers exist purely to tell the world what software and version your server is running. None of that is required for the page to work - it's free reconnaissance handed to anyone probing your site.

The Headers That Leak the Most

Server - often reveals the exact web server software and version (nginx/1.18.0, Apache/2.4.41). A version number is a direct lookup key into public CVE databases.
X-Powered-By - commonly leaks the backend framework (Express, PHP/8.1.2, ASP.NET).
X-Generator - reveals the CMS or site generator in use, narrowing down which known plugin/theme vulnerabilities are worth trying.
X-AspNet-Version / X-AspNetMvc-Version - .NET-specific headers exposing the exact framework version.

How to Fix It

Nginx

Suppress version info in the Server headertypescript

1server_tokens off;

Apache

Reduce Server header to just the product name, no versiontypescript

1ServerTokens Prod
2ServerSignature Off

Express (Node.js)

Disable the X-Powered-By header entirelytypescript

1app.disable("x-powered-by");

ASP.NET

Remove version headerstypescript

1<system.web>
2  <httpRuntime enableVersionHeader="false" />
3</system.web>
4<system.webServer>
5  <httpProtocol>
6    <customHeaders>
7      <remove name="X-Powered-By" />
8    </customHeaders>
9  </httpProtocol>
10</system.webServer>

CMS/generator headers

For X-Generatorand similar CMS-specific headers, check your platform's documentation - most popular CMSs (WordPress, Drupal) have a plugin or one-line config change to suppress it.

How Scanverra Detects This

Scanverra's security scan reads every response header your server sends and flags Server, X-Powered-By, X-Generator, and .NET version headers individually - with higher severity when an actual version number is present versus just a software name.

FAQ

Frequently asked questions

Is hiding my server version actually 'security through obscurity'?

It's a supporting measure, not a substitute for patching - you should absolutely still keep software up to date. But there's no upside to advertising the exact version to every visitor either; it costs an attacker nothing to check, and gives them a head start on which known CVEs to try first.

Does removing these headers cost anything in functionality?

No - Server, X-Powered-By, and X-Generator headers exist purely as informational metadata. No browser or client behavior depends on them, so removing or suppressing them has zero functional downside.

What about verbose error pages in production - is that the same issue?

It's related but more severe - a stack trace or debug page doesn't just reveal a version number, it can reveal file paths, database queries, environment variables, or internal architecture. Same fix category (don't expose internals to end users), higher stakes.

My framework adds X-Powered-By automatically - how do I even find it?

Open your browser's network tab on any page load and check the response headers, or run a security scan - most frameworks (Express, ASP.NET, PHP) add this by default and most have a one-line configuration option to disable it.

See what your headers are leaking

Run a free security headers check and find out exactly what your server reveals to visitors.

Run free audit