Server / framework version disclosureWhat it checks and how to fix it

What it checks

Fetches the homepage and looks for response headers that reveal the software stack: a Server header containing a version number, or any X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version, X-Generator, X-Drupal-Cache or X-Rails-Version header. Any of them gets a warning; none passes.

Why it matters

Version numbers tell an attacker exactly which known vulnerabilities to try, and automated scanners match them against CVE databases to pick targets. Hiding them does not fix an outdated server, but it stops you being shortlisted the moment a new exploit for that version is published.

How to fix it

Remove the version from Server and drop the technology headers entirely.

nginx

server_tokens off;
proxy_hide_header X-Powered-By;
proxy_hide_header X-Runtime;

Apache

ServerTokens Prod
ServerSignature Off
Header always unset X-Powered-By

PHP (php.ini): expose_php = Off

ASP.NET (web.config): <httpRuntime enableVersionHeader="false" /> and remove X-Powered-By under <customHeaders>.

Cloudflare: Rules → Transform Rules → Modify Response Header → remove X-Powered-By (and any other leaking header).

Express: app.disable("x-powered-by")

Rails: Rails sends no version header itself; look for one added by a proxy, gem or the app server, and remove it at the proxy as above.