How to fix server version on WordPress.org

Steps for WordPress.org

1. The fix is identical to WooCommerce above — WordPress.org (self-hosted) shares the same Apache/Nginx server layer.
2. Via .htaccess (Apache): add `Header unset Server` and `Header unset X-Powered-By` and `ServerSignature Off` to your root .htaccess.
3. Via plugin: install 'HTTP Headers' or 'Security Headers' plugin (Dashboard → Plugins → Add New), activate, and configure removal of Server and X-Powered-By headers.
4. For PHP specifically: in wp-config.php or a must-use plugin, you can add `header_remove('X-Powered-By');` before any output is sent. To suppress PHP version exposure also set `expose_php = Off` in php.ini if your host allows it.
5. Contact your host for server-level (ServerTokens) changes if you are on shared hosting without root access.

What is server version?

Every time a browser (or a bot) requests a page from your store, your web server sends back a set of "response headers" — invisible metadata about the response. Two of these headers, `Server` and `X-Powered-By`, often broadcast exactly what software is running your site and which version it is (for example, `Server: Vercel` or `X-Powered-By: Next.js`). This is called "server version disclosure" or "technology fingerprinting." While the header itself doesn't break anything, it acts like a name-badge that tells the whole internet: "Here's exactly what I'm running."

Attackers routinely scan millions of websites looking for servers running known vulnerable versions of software. When your headers announce your exact stack, you become a much easier target — automated exploit tools can match your version against public vulnerability databases (CVEs) and launch targeted attacks in seconds, without any human involvement. Suppressing these headers is a recognised security hardening step that reduces your "attack surface" and is increasingly expected by security audits, PCI-DSS assessments, and enterprise buyers reviewing your store. It also prevents competitors or scrapers from trivially identifying and copying your technology stack. Fixing it is usually a quick-win configuration change that has zero impact on site speed or user experience.

See the complete Server version guide for every platform and the full background.