webzod
account

Remove the version from X-Powered-By on Apache

headers.disclosure.powered_by_version · effort: minutes

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

  1. Set expose_php = Off in php.ini if PHP adds the header. Otherwise remove it in both response tables with the lines below and reload.
apache 
Header unset X-Powered-By
Header always unset X-Powered-By

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.