Is it dangerous if my server shows its version number?

On its own it's low risk, but it makes an attacker's job easier: they can match the exact version to known vulnerabilities and published exploits without any guesswork. Hiding it takes a minute, so it's worth doing, after making sure the software is up to date.

How do I hide the Apache version?

Set ServerTokens Prod and ServerSignature Off in the Apache configuration (on Ubuntu and Debian, in /etc/apache2/conf-available/security.conf), then reload Apache. The Server header will then say only 'Apache'.

How do I remove the X-Powered-By header?

For PHP, set expose_php = Off in php.ini. For Express, call app.disable('x-powered-by') or use helmet. For IIS and ASP.NET, remove it under HTTP Response Headers or in web.config.

Low risk Server · X-Powered-By · version banners

Server leaks version information: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 5 minute read

Short answer: every time someone visits your site, the server tells them exactly which software and version it runs, for example Apache/2.4.7 (Ubuntu) or PHP/7.2.24. That doesn't break in by itself, but it hands attackers a shortcut to the right exploit.

The fix: first make sure the software is up to date, then turn off version details. It's one setting per program, listed below.

What the finding means

Web servers add headers to every response. Some of them announce the software behind the site:

Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/7.2.24
X-AspNet-Version: 4.0.30319

Visitors never see these, but scanners, including attackers' scanners, read them on every request. With an exact version, an attacker can look up its known vulnerabilities in seconds instead of probing to find out.

How serious is it?

FreshScanSentry and OWASP ZAP rate it Low or informational. Hiding the version doesn't remove any vulnerability. A determined attacker can still fingerprint the server in other ways. What it does is take you off the easy list. Automated attacks often pick targets by searching for specific vulnerable version strings.

The real question is what the version says. If it's old, like the Apache/2.4.7 in the example, which dates from 2013, the bigger problem is the outdated software. Fix that first with our guide to outdated OpenSSH and Apache, then hide the banner.

How it looks in your report scanme.nmap.org

80 Web server reveals its software version The web server announces itself as "Apache/2.4.7 (Ubuntu)" Info

Real result from a Basic Scan. Deep Scans report it as "Server Leaks Information via X-Powered-By" and similar.

How to check your site

curl -sI https://your-site.com | grep -iE '^(server|x-powered-by|x-aspnet)'

Any version numbers in the output are what the scan found. Server: Apache or Server: nginx with no number is fine. That's what the fixes below aim for.

How to fix it

Apache. On Ubuntu and Debian edit /etc/apache2/conf-available/security.conf, elsewhere httpd.conf:

ServerTokens Prod
ServerSignature Off

Reload with sudo systemctl reload apache2 (or httpd). The header becomes just Server: Apache, and error pages stop showing the version.

nginx. In the http block of nginx.conf:

server_tokens off;

Reload with sudo systemctl reload nginx. The header becomes Server: nginx. Removing it completely needs the optional headers-more module, which isn't necessary.

PHP (X-Powered-By: PHP/…), in php.ini:

expose_php = Off

Then restart PHP-FPM or the web server. On shared hosting, look for a PHP settings page in the control panel, or ask your host.

Node.js / Express (X-Powered-By: Express):

app.disable('x-powered-by');
// or, with helmet, which also adds other security headers:
app.use(require('helmet')());

IIS and ASP.NET, in the site's web.config (IIS 10 or later for removeServerHeader):

<system.webServer>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>
<system.web>
  <httpRuntime enableVersionHeader="false" />
</system.web>

The last line removes X-AspNet-Version.

WordPress also prints its version in the page itself, as <meta name="generator" content="WordPress …">. Most security plugins have a "hide WordPress version" option. In a theme's functions.php:

remove_action('wp_head', 'wp_generator');

Behind Cloudflare or another CDN? Visitors may see Server: cloudflare, which is fine. Still apply the fixes on your own server, because attackers sometimes find and contact the server directly.

Don't forget SSH

SSH announces its version too (OpenSSH_6.6.1p1 Ubuntu…). It can't be hidden completely, because SSH clients need part of it. On Ubuntu and Debian, DebianBanner no in /etc/ssh/sshd_config removes the operating system details. Keeping OpenSSH updated matters far more. See the outdated OpenSSH guide.

Re-check

Run the curl command again. The headers should show no version numbers, or not appear at all. Then re-scan.

Common questions

Isn't this "security through obscurity"?

Partly, which is why it's rated Low. It's not a replacement for updating. But there's no downside to it, and it removes you from searches that look for one specific vulnerable version.

Can I fake the version instead?

You can, but it gains little and can confuse your own troubleshooting and support. Removing the version is enough.

The finding came back after an update.

Some updates replace configuration files. Check the setting is still there, and keep it in your server setup notes or configuration management.

Sources: Apache: ServerTokens · nginx: server_tokens · PHP: expose_php · ZAP: Server header · ZAP: X-Powered-By · ZAP: X-AspNet-Version · OWASP HTTP Headers cheat sheet