How to fix server version on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. Next.js: add a 'headers()' function in 'next.config.js' that returns a rule matching all paths ('source: "/(.*)")' with 'key: "X-Powered-By", value: ""' set to empty, or use 'poweredByHeader: false' in the config object.
2. Express.js: call 'app.disable("x-powered-by")' immediately after initialising Express, and optionally add Helmet middleware ('npm install helmet; app.use(helmet())') which handles this and other security headers.
3. Vercel deployments: add a 'headers' array in 'vercel.json' with source '/(.*)', setting X-Powered-By to an empty value or removing it (see code snippet).
4. Netlify: add a '_headers' file in your publish directory with a '/*' route and 'X-Powered-By: ' (empty) line, or configure in 'netlify.toml'.
5. Cloudflare Workers / Pages: use a custom Worker script to intercept responses and call 'response.headers.delete("X-Powered-By")' before returning.
6. Verify with 'curl -I https://yourdomain.com' or DevTools that no version information is present.

What is server version?

Every time a browser (or a bot) requests a page from your store, your web server sends back a set of "response headers" — invisible metadata about the response. Two of these headers, `Server` and `X-Powered-By`, often broadcast exactly what software is running your site and which version it is (for example, `Server: Vercel` or `X-Powered-By: Next.js`). This is called "server version disclosure" or "technology fingerprinting." While the header itself doesn't break anything, it acts like a name-badge that tells the whole internet: "Here's exactly what I'm running."

Attackers routinely scan millions of websites looking for servers running known vulnerable versions of software. When your headers announce your exact stack, you become a much easier target — automated exploit tools can match your version against public vulnerability databases (CVEs) and launch targeted attacks in seconds, without any human involvement. Suppressing these headers is a recognised security hardening step that reduces your "attack surface" and is increasingly expected by security audits, PCI-DSS assessments, and enterprise buyers reviewing your store. It also prevents competitors or scrapers from trivially identifying and copying your technology stack. Fixing it is usually a quick-win configuration change that has zero impact on site speed or user experience.

See the complete Server version guide for every platform and the full background.