Server Information Leakage: How to Stop Exposing Your Stack
- October 11, 2025
- Security, Information Disclosure
Your server is announcing what software it runs and which version, through headers like Server, X-Powered-By, and X-AspNet-Version. That hands attackers a free map for matching your stack against known vulnerabilities. It is a low-severity finding on its own and not a ranking factor, but it is cheap to fix. Strip or mask these headers in your web server config and PHP settings, then confirm with a quick curl check.
What this check flags
Every HTTP response your site sends carries a set of headers. Some are necessary. Others quietly volunteer details about the machinery behind the page. This check looks for the chatty ones. The usual suspects are the Server header (often something like "Apache/2.4.41 (Ubuntu)" or "nginx/1.18.0"), X-Powered-By (commonly "PHP/8.1.2" or "Express"), and on Microsoft stacks X-AspNet-Version and X-AspNetMvc-Version.
The problem is not that these headers exist. It is that they include version numbers. "nginx" tells an attacker very little. "nginx/1.18.0" tells them exactly which published vulnerabilities might apply. The OWASP guidance is direct: remove these headers or set non-informative values.
Why it matters (and why it does not, honestly)
Let me be straight about severity. This finding is low risk in isolation. Nobody breaks into a server because the Server header said "Apache". And it is not an SEO ranking factor, so do not expect a traffic bump from fixing it. If anyone tells you hiding your server version moves you up in Google, they are selling something.
What it does do is feed reconnaissance. Attackers script the boring part of their work. They crawl wide, record which sites run which versions, and circle back when a fresh CVE drops for that exact build. By exposing the version, you make yourself easy to catalog and easy to target later. Removing the header does not make you invulnerable, since attackers have other fingerprinting tricks, but it removes the gift-wrapped answer. This is defense in depth: many small, cheap reductions in your attack surface. This one takes a few minutes, so there is no reason to skip it.
How to fix it
Pick the sections that match your stack. Most sites only need one or two of these.
Apache. Edit your main config (httpd.conf or apache2.conf) and add two directives. ServerTokens Prod trims the Server header down to just "Apache" with no version. ServerSignature Off removes the version line from generated error pages.
ServerTokens Prod
ServerSignature OffNginx. Inside the http block of nginx.conf, switch off the token. This drops the version number, though it still reports "nginx" as the server name.
http {
server_tokens off;
}PHP. PHP appends its version to X-Powered-By by default. Open php.ini, find expose_php, and turn it off.
expose_php = OffStubborn or app-injected headers. Sometimes a framework or CMS adds X-Powered-By and config flags do not catch it. You can strip headers at the web server. In Apache (with mod_headers enabled) add this to your config or .htaccess:
Header unset X-Powered-By
Header unset X-AspNet-Version
Header unset X-AspNetMvc-VersionIn Nginx, use the headers-more module to clear what server_tokens cannot reach:
more_clear_headers 'Server';
more_clear_headers 'X-Powered-By';Reload or restart the service after any change so it takes effect.
How to diagnose it
You do not need a scanner to check this. The -I flag asks curl for headers only.
curl -I https://yoursite.comRead the output. If you see "Server: Apache" with no version, and no X-Powered-By line at all, you are in good shape. If you still see version numbers, the change has not applied yet. To filter for the specific lines:
curl -sI https://yoursite.com | grep -iE 'server|powered|version'Common mistakes
Fixing one layer and forgetting the rest. You can set ServerTokens Prod and still leak PHP through X-Powered-By, or strip X-Powered-By and still broadcast the Apache version. Check every header in your curl output, not just the one the audit named.
Editing the wrong file. A directive in a virtual host or .htaccess can be overridden elsewhere, and ServerTokens only works at the main server config level in many setups. If a change does not show up, you are likely editing a file that is not the one in charge.
Testing a cached response. A CDN or reverse proxy in front of your origin may add or rewrite headers, or serve a stale cached copy. The header you see may be the proxy talking, not your server. Test the origin directly and check your CDN settings too.
Treating this as your whole security posture. Hidden version numbers slow reconnaissance. They do not patch anything. Keep your software updated, because a hidden vulnerable version is still a vulnerable version.
FAQ
A. No. This is a security hygiene item, not a ranking signal. Fix it because it is good practice and quick, not for SEO gains.
A. Because the easy path is the one most automated scans use. Other fingerprinting takes more effort and is less reliable. Removing the obvious tell raises the cost of targeting you, which is the whole point of defense in depth.
A. On Nginx you can with the headers-more module, and on Apache you can mask the value with mod_security. Standard Apache and Nginx config will trim the version but keep the product name. Trimming the version is enough to clear this check.
Need a full technical audit?
SEO ProCheck runs deep crawls that catch issues like this across your whole site.
Claude Vincent is a technical SEO consultant focused on crawlability, rendering, and AI-search visibility. He writes the field guides and case studies at SEO ProCheck, with a bias toward the durable, unglamorous work that decides whether search engines and AI answer engines can actually read and cite a site.
About SEO ProCheck
Technical SEO consulting and GEO strategy with 20 years of enterprise experience. Case studies, resources, and tools for search and AI visibility.
Work With Me
Technical SEO audits, GEO strategy, site migrations, and international SEO. Hourly consulting for teams who need hands-on support, not just reports.
Subscribe to our newsletter!
