Remove the version from X-Powered-By on Cloudflare

headers.disclosure.powered_by_version · effort: minutes

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

Open Rules, Settings, Managed Transforms and turn on Remove X-Powered-By headers.
Or add a Response Header Transform Rule with a Remove operation for X-Powered-By.

Read the documentation (opens in a new tab)

Reported by the Version disclosure check
Hide the server version number
Remove framework version headers

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related