Security headers

Hide public server version numbers

Why this matters

Server version numbers can help attackers choose known weaknesses to try. Hiding them is useful, but keeping software updated still matters.

What to do

1. Ask your host whether the Server and X-Powered-By response headers show software versions. Headers are details the server sends with a page.
2. Ask them to turn off version numbers in both headers, or remove the optional X-Powered-By header entirely.
3. What to tell your web developer: Please remove software version numbers from Server and X-Powered-By in the public response. Keep the underlying software updated as well.

How to check the fix

Run the checker again. The version announcement advisory should disappear; this check is omitted when no version number is spotted.