webzod
account

Remove the version from X-Powered-By on nginx

headers.disclosure.powered_by_version · effort: minutes

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

  1. Hide the header from the backend in the http or server block, run sudo nginx -t and reload. Use fastcgi_hide_header for PHP-FPM and proxy_hide_header for proxied applications.
  2. A location with proxy_hide_header or fastcgi_hide_header lines of its own does not inherit the server-level ones, so repeat these lines there.
nginx 
fastcgi_hide_header X-Powered-By;
proxy_hide_header X-Powered-By;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.