en
/login
Koval SEO

Server headers name software versions

In the reportServer headers disclose software versions

server_version_disclosure · Review item

Short answer

This security advice appears when a Server or X-Powered-By header includes a product version such as Apache/2.4.41, or X-AspNet-Version gives a bare version such as 4.0.30319. Such detail can make known weaknesses easier to look up. Remove the version, or the header, at your server or CDN.

Severity: Notice. Security advice in Good to know. Hiding a version is optional hygiene; keeping software updated matters more, and no vulnerability or ranking effect is established.

Why it matters

MDN notes that a Server header with fine-grained details about the server software may make known vulnerabilities easier to detect and advises against too much detail, while calling the benefit of hiding it debatable.

What to do

  1. Look at the finding: it shows the exact header line and up to ten pages that send it.
  2. Turn the version off in your server's settings, for example server_tokens off in nginx or ServerTokens Prod in Apache, and stop your application from sending X-Powered-By.
  3. Keep the software itself up to date: that is what closes known weaknesses.

When to leave it as it is: if your host or CDN sets the header and you cannot change it, you can leave it; keeping the software updated matters more.

What we read

We read the Server, X-Powered-By and X-AspNet-Version headers on the final response of each crawled page, with our own user agent. For Server and X-Powered-By, a product/version token such as Apache/2.4.41 or PHP/8.1 is reported; a bare product name such as nginx is not. X-AspNet-Version is reported when its entire value is a version token such as 4.0.30319, even without a product name.

Pages that send the same header line are reported together, one finding per exact line. A version written only in a comment or in free text, such as nginx (1.24.0) or PHP 7.4.3, is not read as a version, and the page is marked as not checked for that header.

Example & evidence

Illustrative example — one response, not a live audit.

https://bakery.example/ and its other pages send:

Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/8.1.2

Both headers name a version, so each line is reported with the pages that send it.

Server: Apache

A possible correction: ServerTokens Prod leaves only the product name, and expose_php = Off removes X-Powered-By.

Confirm & check again

Check for yourself: open the page's response headers in your browser's developer tools and read Server and X-Powered-By.

Check again: Full audit — run a new full audit. With complete rule coverage, including no ambiguous version header that blocks a conclusion, this finding for the exact header line closes only when no currently crawled page still sends it; a new page with the old line keeps it open. A changed version is a different header line and may create another finding.

Limits & sources

The check reads three headers only, not Via, other headers or a generator tag in the HTML, and says nothing about whether the version is vulnerable. A CDN in front of your server may add or rewrite Server.

Confidence: High because the headers are read directly.

Sources

  • MDN, Server header — notes that a Server header with fine-grained implementation details may make known vulnerabilities easier to detect, while calling the benefit of hiding it debatable. Checked 28 September 2026.

Editorial review: 2 November 2026