Remove the version from X-Powered-By on WordPress

Why it matters

X-Powered-By with a version number advertises the exact framework or PHP release you run, pointing attackers straight at its known vulnerabilities. Browsers do not need the header at all.

The fix

1. The header comes from PHP. Set expose_php = Off in php.ini or your host's PHP settings (it cannot be changed from .htaccess or .user.ini); ask the host if you cannot.
2. As a fallback for pages WordPress renders, the must-use plugin below removes it.

<?php
/*
 * Plugin Name: Remove X-Powered-By
 */
add_action( 'send_headers', function () {
	header_remove( 'X-Powered-By' );
} );

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Version disclosure check
• Hide the server version number
• Remove framework version headers