Server and X-Powered-By
Headers that advertise exactly which software and version you run.
Recommended value
Server and X-Powered-By: (remove, or strip the version)
What it does
Server: nginx/1.18.0 and X-Powered-By: PHP/7.4.3 tell an attacker precisely which published exploits to try, and turn mass scanning for a new CVE into a trivial exercise.
This is not a vulnerability on its own — nobody gets in because of a version string. But it costs nothing to remove and it removes you from the results of exactly the sort of untargeted internet-wide scan that finds most compromised servers.
Related headers worth stripping: X-AspNet-Version, X-AspNetMvc-Version, X-Generator, and framework-specific debug headers.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: