Server version
Quick winFound on 1% of audited stores.
Remove or suppress HTTP response headers that advertise your server software name and version to the public internet.
What it is
Every time a browser (or a bot) requests a page from your store, your web server sends back a set of "response headers" — invisible metadata about the response. Two of these headers, `Server` and `X-Powered-By`, often broadcast exactly what software is running your site and which version it is (for example, `Server: Vercel` or `X-Powered-By: Next.js`). This is called "server version disclosure" or "technology fingerprinting." While the header itself doesn't break anything, it acts like a name-badge that tells the whole internet: "Here's exactly what I'm running."
Why it matters
Attackers routinely scan millions of websites looking for servers running known vulnerable versions of software. When your headers announce your exact stack, you become a much easier target — automated exploit tools can match your version against public vulnerability databases (CVEs) and launch targeted attacks in seconds, without any human involvement. Suppressing these headers is a recognised security hardening step that reduces your "attack surface" and is increasingly expected by security audits, PCI-DSS assessments, and enterprise buyers reviewing your store. It also prevents competitors or scrapers from trivially identifying and copying your technology stack. Fixing it is usually a quick-win configuration change that has zero impact on site speed or user experience.
How to fix it
- Audit which headers are being sent: open your browser DevTools (F12 → Network tab), reload any page, click the first request, and look at the Response Headers panel for 'Server', 'X-Powered-By', 'X-AspNet-Version', 'X-Generator', or similar.
- Identify where the header is set: it may come from your hosting platform, your CDN/edge network, your application framework, or a combination of all three — each layer must be addressed separately.
- Suppress or replace the 'Server' header at the hosting/CDN layer — most managed platforms let you do this via a configuration file (vercel.json, netlify.toml, _headers, etc.) or a dashboard setting.
- Remove the 'X-Powered-By' header at the application/framework layer — for example, in Express.js call app.disable('x-powered-by'); in Next.js add a custom headers rule in next.config.js.
- If you cannot remove a header entirely on your platform, replace the value with a generic string (e.g. 'Server: web') so it reveals nothing useful.
- Re-verify by reloading the page in DevTools or using a free online header-checker tool (e.g. securityheaders.com) to confirm the disclosing headers are gone or neutralised.
Fix it on your platform
Pick your platform for the exact steps.
How to fix server version on Shopify
- Shopify's infrastructure manages the 'Server' header automatically and does not expose a configurable value — you cannot change it from the admin.
- If you have a custom storefront or middleware (e.g. a Node/Express proxy), add 'app.disable("x-powered-by")' and 'app.use((req, res, next) => { res.removeHeader("X-Powered-By"); next(); })' in your server entry file.
- For Shopify Hydrogen (Remix/Next.js) storefronts deployed to Oxygen, add custom headers in your 'server.ts' entry: use Remix's 'headers()' export or a middleware to delete the header before responding.
- Verify in DevTools (Network tab → Response Headers) that no version string appears.
How to fix server version on Shopify Plus
- Same as Shopify above — the core Liquid storefront headers are managed by Shopify's CDN and cannot be changed from the merchant admin.
- For custom Hydrogen/headless deployments on Oxygen or an external host, follow the Headless / Custom steps below.
- Engage your Shopify Plus Merchant Success Manager if a PCI or security audit specifically requires header suppression evidence — they can provide platform attestations.
How to fix server version on WooCommerce
- In your WordPress root (or in a must-use plugin), add this to suppress PHP/WordPress disclosure: add_filter('wp_headers', function($headers){ unset($headers['X-Powered-By']); return $headers; });
- In your server config (Apache): add 'Header unset X-Powered-By' and 'ServerTokens Prod' and 'ServerSignature Off' inside your VirtualHost or .htaccess file.
- In your server config (Nginx): add 'server_tokens off;' in the http{} or server{} block, and 'more_clear_headers X-Powered-By;' (requires ngx_headers_more module) or handle via FastCGI params.
- If using a managed host (WP Engine, Kinsta, Cloudways), check their dashboard Security or Server Settings panel — most expose a toggle or do it automatically. Contact support to confirm.
- Install the 'HTTP Headers' WordPress plugin (free, by 8Degree Themes) for a no-code UI to remove specific response headers without editing server files.
- Verify with DevTools or a header-checker that 'X-Powered-By: PHP/x.x' and 'Server: Apache/x.x' are gone.
How to fix server version on BigCommerce
- BigCommerce's SaaS infrastructure controls the 'Server' header — it is not configurable from the merchant admin.
- For custom middleware or API-driven storefronts (Catalyst/Next.js), add header suppression in your 'next.config.js' (see code snippets below) and deploy via Vercel or your chosen host.
- If using Cloudflare in front of BigCommerce, create a Cloudflare Transform Rule (Rules → Transform Rules → Modify Response Header) to delete 'X-Powered-By' and set 'Server' to a generic value.
- Verify via DevTools that no technology version string is visible in response headers.
How to fix server version on Wix
- Wix manages all server infrastructure; you cannot directly edit 'Server' or 'X-Powered-By' headers from the Wix dashboard.
- If you use Wix Velo (code-based features), you can add custom response headers in a backend web module ('http-functions.js'): use 'response.headers.set()' to overwrite values, but note Wix may still inject its own headers.
- Place a CDN or reverse proxy (e.g. Cloudflare) in front of your Wix site, then use Cloudflare Transform Rules to delete or overwrite the disclosing headers at the edge.
- For Wix Enterprise, contact Wix support to request header suppression — they may be able to configure it at the infrastructure level.
How to fix server version on Wix Studio
- Same approach as Wix above — server headers are infrastructure-managed and not directly editable in the Studio editor.
- Use Wix Studio's Velo backend ('http-functions.js') for any custom API responses, setting headers explicitly there.
- Add Cloudflare as a proxy layer and use Transform Rules (Rules → Transform Rules → Modify Response Header → Remove) to strip 'X-Powered-By' and replace 'Server'.
How to fix server version on Squarespace
- Squarespace manages its own infrastructure; 'Server' and 'X-Powered-By' headers are not configurable from the admin panel.
- Route traffic through Cloudflare (point your nameservers to Cloudflare in 'orange-cloud' / proxy mode), then use a Transform Rule to delete 'X-Powered-By' and set 'Server' to a neutral value.
- Navigate to Cloudflare: Rules → Transform Rules → Modify Response Header → Create Rule → Remove header → 'X-Powered-By'. Repeat for any other disclosing headers.
- Verify the fix by checking response headers in DevTools after Cloudflare propagation (may take a few minutes).
How to fix server version on Webflow
- Webflow's hosting layer controls 'Server' headers — they cannot be changed from the Webflow Designer or Project Settings.
- For custom code or API calls made from Webflow Logic or embedded scripts, ensure any server-side code you control suppresses its own headers.
- Add Cloudflare as a proxy (set Webflow's custom domain DNS to Cloudflare, enable proxy/orange-cloud), then use Rules → Transform Rules → Modify Response Header to remove 'X-Powered-By'.
- Verify in DevTools that the header is absent or neutralised after Cloudflare is active.
How to fix server version on Adobe Commerce (Magento)
- In Nginx (recommended for production), add 'server_tokens off;' to the 'http {}' block in '/etc/nginx/nginx.conf', and add 'fastcgi_hide_header X-Powered-By;' in the relevant 'location ~ \.php$' block.
- In Apache, add 'ServerTokens Prod', 'ServerSignature Off', and 'Header unset X-Powered-By' in your VirtualHost config or '.htaccess'.
- In 'php.ini' (or 'php-fpm.conf'), set 'expose_php = Off' to prevent PHP from adding 'X-Powered-By: PHP/x.x' headers.
- If using Varnish in front of Magento, add 'unset beresp.http.X-Powered-By; unset beresp.http.Server;' in your VCL 'vcl_backend_response' subroutine.
- In Adobe Commerce Cloud (Magento Cloud), modify '.magento.app.yaml' or use the Fastly CDN service (included) → navigate to Fastly configuration → add a custom VCL snippet to strip headers.
- Run 'curl -I https://yourdomain.com' from a terminal or use a header-checker tool to confirm no version strings appear in the response.
How to fix server version on Magento Open Source
- Follow the same Nginx/Apache/PHP steps as Adobe Commerce (Magento) above — the application layer is identical.
- Add 'expose_php = Off' in 'php.ini' and 'server_tokens off;' in Nginx config, then restart both services.
- Verify with 'curl -I https://yourdomain.com' to confirm headers are suppressed.
How to fix server version on Headless / Custom (I build in code)
- Next.js: add a 'headers()' function in 'next.config.js' that returns a rule matching all paths ('source: "/(.*)")' with 'key: "X-Powered-By", value: ""' set to empty, or use 'poweredByHeader: false' in the config object.
- Express.js: call 'app.disable("x-powered-by")' immediately after initialising Express, and optionally add Helmet middleware ('npm install helmet; app.use(helmet())') which handles this and other security headers.
- Vercel deployments: add a 'headers' array in 'vercel.json' with source '/(.*)', setting X-Powered-By to an empty value or removing it (see code snippet).
- Netlify: add a '_headers' file in your publish directory with a '/*' route and 'X-Powered-By: ' (empty) line, or configure in 'netlify.toml'.
- Cloudflare Workers / Pages: use a custom Worker script to intercept responses and call 'response.headers.delete("X-Powered-By")' before returning.
- Verify with 'curl -I https://yourdomain.com' or DevTools that no version information is present.
How to fix server version on PrestaShop
- Add 'expose_php = Off' in 'php.ini' to remove 'X-Powered-By: PHP/x.x'.
- In Apache, add 'Header unset X-Powered-By', 'ServerTokens Prod', and 'ServerSignature Off' to your VirtualHost or '.htaccess'.
- In Nginx, add 'server_tokens off;' and 'fastcgi_hide_header X-Powered-By;' to your server block.
- Optionally install a PrestaShop security module (e.g. 'Security Lite') that can add/remove response headers from the admin back office.
- Verify via DevTools or 'curl -I' that the headers no longer reveal software versions.
How to fix server version on OpenCart
- Set 'expose_php = Off' in 'php.ini'.
- In Apache, add 'Header unset X-Powered-By' and 'ServerTokens Prod' to '.htaccess' or your VirtualHost.
- In Nginx, set 'server_tokens off;' and 'fastcgi_hide_header X-Powered-By;' in the server block.
- Verify with DevTools that no software version appears in response headers.
How to fix server version on WordPress.org
- The fix is identical to WooCommerce above — WordPress.org (self-hosted) shares the same Apache/Nginx server layer.
- Via .htaccess (Apache): add `Header unset Server` and `Header unset X-Powered-By` and `ServerSignature Off` to your root .htaccess.
- Via plugin: install 'HTTP Headers' or 'Security Headers' plugin (Dashboard → Plugins → Add New), activate, and configure removal of Server and X-Powered-By headers.
- For PHP specifically: in wp-config.php or a must-use plugin, you can add `header_remove('X-Powered-By');` before any output is sent. To suppress PHP version exposure also set `expose_php = Off` in php.ini if your host allows it.
- Contact your host for server-level (ServerTokens) changes if you are on shared hosting without root access.
Does your site have this issue?
Run a free SEOLZ scan to find server version — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Server version?
Every time a browser (or a bot) requests a page from your store, your web server sends back a set of "response headers" — invisible metadata about the response. Two of these headers, `Server` and `X-Powered-By`, often broadcast exactly what software is running your site and which version it is (for example, `Server: Vercel` or `X-Powered-By: Next.js`). This is called "server version disclosure" or "technology fingerprinting." While the header itself doesn't break anything, it acts like a name-badge that tells the whole internet: "Here's exactly what I'm running."
Why does server version matter?
Attackers routinely scan millions of websites looking for servers running known vulnerable versions of software. When your headers announce your exact stack, you become a much easier target — automated exploit tools can match your version against public vulnerability databases (CVEs) and launch targeted attacks in seconds, without any human involvement. Suppressing these headers is a recognised security hardening step that reduces your "attack surface" and is increasingly expected by security audits, PCI-DSS assessments, and enterprise buyers reviewing your store. It also prevents competitors or scrapers from trivially identifying and copying your technology stack. Fixing it is usually a quick-win configuration change that has zero impact on site speed or user experience.
How do I fix server version?
Remove or suppress HTTP response headers that advertise your server software name and version to the public internet.