How to fix server version on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. In Nginx (recommended for production), add 'server_tokens off;' to the 'http {}' block in '/etc/nginx/nginx.conf', and add 'fastcgi_hide_header X-Powered-By;' in the relevant 'location ~ \.php$' block.
2. In Apache, add 'ServerTokens Prod', 'ServerSignature Off', and 'Header unset X-Powered-By' in your VirtualHost config or '.htaccess'.
3. In 'php.ini' (or 'php-fpm.conf'), set 'expose_php = Off' to prevent PHP from adding 'X-Powered-By: PHP/x.x' headers.
4. If using Varnish in front of Magento, add 'unset beresp.http.X-Powered-By; unset beresp.http.Server;' in your VCL 'vcl_backend_response' subroutine.
5. In Adobe Commerce Cloud (Magento Cloud), modify '.magento.app.yaml' or use the Fastly CDN service (included) → navigate to Fastly configuration → add a custom VCL snippet to strip headers.
6. Run 'curl -I https://yourdomain.com' from a terminal or use a header-checker tool to confirm no version strings appear in the response.

What is server version?

Every time a browser (or a bot) requests a page from your store, your web server sends back a set of "response headers" — invisible metadata about the response. Two of these headers, `Server` and `X-Powered-By`, often broadcast exactly what software is running your site and which version it is (for example, `Server: Vercel` or `X-Powered-By: Next.js`). This is called "server version disclosure" or "technology fingerprinting." While the header itself doesn't break anything, it acts like a name-badge that tells the whole internet: "Here's exactly what I'm running."

Attackers routinely scan millions of websites looking for servers running known vulnerable versions of software. When your headers announce your exact stack, you become a much easier target — automated exploit tools can match your version against public vulnerability databases (CVEs) and launch targeted attacks in seconds, without any human involvement. Suppressing these headers is a recognised security hardening step that reduces your "attack surface" and is increasingly expected by security audits, PCI-DSS assessments, and enterprise buyers reviewing your store. It also prevents competitors or scrapers from trivially identifying and copying your technology stack. Fixing it is usually a quick-win configuration change that has zero impact on site speed or user experience.

See the complete Server version guide for every platform and the full background.