Does your server announce its software versions?
Response headers and page markers that announce exact software versions, such as your web server, PHP or framework, and whether those versions are past their end of life.
Why it matters
Exact versions tell an attacker which known weaknesses to try first. Software past its end of life gets no more security fixes, which matters much more than the header itself.
How a survey checks it
Passive check: part of every free survey.
We read the headers and markers your homepage sends. When a Linux distribution may have patched an old version quietly, we lower the severity rather than guess.
How to fix it
- Turn off version numbers in the Server and X-Powered-By headers in your web server or framework settings.
- Upgrade any software that is past its end of life. Hiding the version does not make old software safe.
Prefer us to do it? Ask for a fix quote
Common questions
Is hiding version numbers security through obscurity?
Partly, which is why it is rated low. It removes an easy hint, but keeping software up to date is what actually protects you.
My host controls the server. What can I do?
Ask your host, or check whether they offer a setting. On many managed platforms these headers are already removed.