probeo

How to remove the X-Powered-By header?

x-powered-by-present global

The issue

X-Powered-By announces the framework or runtime behind every response, sometimes with its version. It does nothing for browsers and saves attackers a step.

The cause is a default. Express, PHP, ASP.NET and others add the header unless configured not to.

Scope

The header comes from the application or server, so it is on every response they produce. Probeo flags X-Powered-By on each response it fetches, at its highest severity, because it names a framework.

How to check you have it

  • In probeo: the header is recorded as header:x-powered-by.
  • By hand: run curl -sI https://example.com/ and look for x-powered-by. Check a static file and an error page too.

The fix

Turn the header off where it is added.

In Express, call app.disable('x-powered-by'). In PHP, set expose_php = Off. If the application can’t be changed, strip the header at the reverse proxy or CDN.

Done when: no response carries X-Powered-By, and the check above comes back clean.

Do not

  • Do not replace it with a custom header that discloses the same thing.
  • Do not keep it because the version is current.

FAQ

Does removing X-Powered-By prevent framework identification?

No. It increases the effort required. Default error pages, URL patterns, and response timing can still reveal the framework. Removal eliminates the most obvious disclosure but other fingerprints may remain. Defense in depth requires addressing multiple information sources.

Can the header serve monitoring or debugging purposes?

Not effectively. Internal monitoring systems have better information sources. The header appears in external responses where it provides reconnaissance value. Use server logs, metrics systems, or internal headers that do not reach public responses.

What other headers leak similar information?

Server headers often include version details. Set-Cookie may reveal framework-specific session patterns. X-AspNet-Version and X-Generator provide additional clues. A complete approach addresses all information-leaking headers, not just X-Powered-By.

Does header removal affect caching or CDN behavior?

No. X-Powered-By is not used by caching logic. CDNs forward or strip the header based on their configuration. Removal at origin prevents the header from reaching CDN and clients. Functionality remains unchanged.

Should the Server header be removed as well?

Consider it. Server headers often include software and version information. Some environments make Server harder to remove than X-Powered-By. Generic Server values reduce disclosure without full removal. The balance depends on configuration flexibility and security requirements.

When does technology disclosure matter most?

When running software with known vulnerabilities or when targeted attacks are likely. High-value targets benefit most from reducing reconnaissance efficiency. For most sites, header removal is a low-effort improvement with clear benefit, regardless of current threat level.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.