Info disclosure server
Quick winRemove or suppress the HTTP `Server` response header so your web server no longer advertises its software name and version number to the public internet.
What it is
Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.
Why it matters
Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.
How to fix it
- Identify where HTTP responses originate: your hosting provider's managed infrastructure, a CDN/reverse-proxy (Cloudflare, Fastly, AWS CloudFront), or a server you control directly (VPS/dedicated).
- If you control the server config, edit the relevant server software config file (nginx: `nginx.conf`; Apache: `httpd.conf` or `.htaccess`; LiteSpeed/OpenLiteSpeed: server settings panel) to suppress or replace the `Server` header value.
- If traffic passes through a CDN or reverse-proxy (Cloudflare, Fastly, etc.), use that platform's header-transform rules to remove or overwrite the `Server` header before it reaches the end user — this is often the easiest fix and doesn't require server access.
- If your platform is fully managed (Shopify, Wix, Squarespace, BigCommerce SaaS), the server layer is controlled by the platform vendor; contact their support or use any available HTTP-header override settings, and note that most managed platforms already strip or sanitise this header.
- After making the change, verify by running `curl -I https://yourdomain.com` in a terminal or using an online HTTP header checker — the `Server` header should be absent or show a generic placeholder (e.g., `Server: cloudflare`) with no version number.
- Re-run your security scanner to confirm the finding is resolved, and add this check to a recurring security review schedule.
Fix it on your platform
Pick your platform for the exact steps.
How to fix info disclosure server on Shopify
- Shopify's infrastructure is fully managed — the `Server` header is controlled by Shopify, not by theme code or admin settings.
- As a merchant you cannot modify server-level headers directly; Shopify already suppresses detailed version information.
- If a scanner still flags a `Server` header value on your Shopify storefront, open a support ticket with Shopify Plus support (for Plus merchants) referencing the specific header value, or route all traffic through Cloudflare (see Cloudflare steps below) to strip the header at the CDN edge before it reaches end users.
How to fix info disclosure server on Shopify Plus
- Same as Shopify — server infrastructure is managed by Shopify.
- For compliance requirements, use Cloudflare as a reverse-proxy in front of your Shopify Plus storefront: point your domain's DNS to Cloudflare (orange-cloud proxy enabled), then add a Cloudflare Transform Rule to remove the `Server` response header (see Cloudflare steps).
- Contact your Shopify Plus launch engineer or support team to document that the header is platform-controlled for any PCI/compliance evidence package.
How to fix info disclosure server on WooCommerce
- WooCommerce runs on WordPress, so the fix lives at the web-server level of your hosting account — not inside the WooCommerce or WordPress admin.
- For *nginx hosting*: SSH into your server, open `/etc/nginx/nginx.conf` (or the server block file for your site, often in `/etc/nginx/sites-available/`). Inside the `http {}` block add `server_tokens off;`. Save and run `sudo nginx -t && sudo systemctl reload nginx`.
- For *Apache hosting*: Open or create a `.htaccess` file in your WordPress root (`public_html/`) and add `ServerTokens Prod` and `ServerSignature Off` — note these directives require `AllowOverride All` or must go in `httpd.conf`; on shared hosting you may need to ask your host to set them.
- For *cPanel/shared hosting*: Contact your hosting provider and request they set `ServerTokens Prod` at the Apache level, or install the *'Headers and Options'* or *'LiteSpeed Cache'* plugin (LiteSpeed Cache > Toolbox > Config tab has a 'Hide Server Signature' option if on LiteSpeed servers).
- Alternatively, install the WordPress plugin *'HTTP Headers'* (by Fer Urbina) or *'Security Headers'* (by Patrick Labbé) — these allow you to add a custom `Server` header value or remove it via PHP's `header_remove('Server')` hook, which works for PHP-generated responses but may not affect static assets served directly by the web server.
- Verify with `curl -I https://yourdomain.com` — the `Server` line should be absent or show only `nginx` or `Apache` with no version.
How to fix info disclosure server on BigCommerce
- BigCommerce SaaS storefronts run on infrastructure fully managed by BigCommerce — you cannot modify the `Server` header from the store admin.
- Log in to your BigCommerce control panel, go to *Server Settings* — there is no native `Server` header control for SaaS plans.
- The most effective solution for BigCommerce merchants is to route traffic through *Cloudflare* (free or paid): update your domain's nameservers to Cloudflare, enable the proxy (orange cloud), then create a *Transform Rule* under Rules > Transform Rules > Modify Response Header to Remove the `Server` header.
- For enterprise/dedicated BigCommerce plans, contact BigCommerce Enterprise support to request banner suppression at the infrastructure level and obtain documentation for compliance audits.
How to fix info disclosure server on Wix
- Wix is a fully managed SaaS platform — `Server` header configuration is controlled by Wix infrastructure and cannot be changed from the Wix Editor or dashboard.
- If your audit flags a `Server` header on a Wix site, this is a platform-level behaviour; submit a feedback/support request to Wix via the Help Center.
- As a workaround for compliance, document in your audit evidence that the server layer is managed by Wix (a SOC 2 certified vendor) and is outside merchant control.
- Premium Wix sites connected to a custom domain can optionally route through Cloudflare as a proxy — in your domain registrar, point the domain's nameservers (or A record) to Cloudflare with proxying enabled, then use a Transform Rule to strip the `Server` header.
How to fix info disclosure server on Squarespace
- Squarespace is a fully managed SaaS platform — `Server` headers are set by Squarespace's infrastructure and are not configurable from the Pages, Design, or Settings panels.
- Contact Squarespace Support via the Help Center to report the finding and ask for documentation confirming their infrastructure-level header policy for compliance purposes.
- To gain control over headers, proxy your Squarespace site through *Cloudflare*: in your domain registrar (or Squarespace Domains panel), update nameservers to Cloudflare, enable the proxy, and add a Transform Rule to remove or overwrite the `Server` response header.
How to fix info disclosure server on Webflow
- Webflow hosting is managed by Webflow — the `Server` header is not configurable from the Webflow Designer or Project Settings.
- For sites on Webflow's own hosting (*.webflow.io or custom domain via Webflow DNS), contact Webflow Support to report the finding.
- The recommended merchant-accessible fix is to use *Cloudflare as a proxy*: in Webflow Project Settings > Hosting, note your site's IP/CNAME, then configure your domain in Cloudflare with the proxy enabled. Add a Cloudflare *Transform Rule* (Rules > Transform Rules > Modify Response Header) to remove the `Server` header.
- Verify by running `curl -I https://yourdomain.com` — the `Server` header should disappear or show `cloudflare`.
How to fix info disclosure server on Adobe Commerce (Magento)
- Adobe Commerce (self-hosted or cloud) typically runs on nginx or Apache — the fix is made at the web-server configuration level on your server or in Adobe Commerce Cloud's configuration.
- For *Adobe Commerce Cloud* (PaaS): edit the `.magento/routes.yaml` or the nginx configuration snippets in `.magento.app.yaml`. Under the `web > locations` section you can add custom headers. For suppressing `Server`, the most reliable approach is to add an upstream Fastly (the included CDN) custom VCL snippet to unset `beresp.http.Server` in `vcl_fetch`.
- In the *Fastly admin* (within Adobe Commerce Cloud admin > Stores > Configuration > Advanced > System > Full Page Cache > Fastly Configuration): go to Custom VCL Snippets, add a new snippet of type `fetch` with content: `unset beresp.http.Server;`
- For *self-hosted Magento on nginx*: SSH to the server, open `/etc/nginx/nginx.conf` or your Magento vhost file and add `server_tokens off;` inside the `http {}` or `server {}` block. Reload nginx: `sudo nginx -t && sudo systemctl reload nginx`.
- For *self-hosted on Apache*: in your vhost config or `.htaccess` add `ServerTokens Prod` and `ServerSignature Off`. Restart Apache.
- Verify with `curl -I https://yourdomain.com` — no version number should appear in the `Server` header.
How to fix info disclosure server on Headless / Custom (I build in code)
- For *nginx*: in `nginx.conf` inside the `http {}` block, add `server_tokens off;`. For a fully blank header, install the `headers-more-nginx-module` and add `more_clear_headers Server;` or `more_set_headers 'Server: ';`.
- For *Apache*: in `httpd.conf` or the relevant VirtualHost config, set `ServerTokens Prod` and `ServerSignature Off`. To completely remove the header, use `mod_headers`: `Header unset Server`.
- For *Node.js / Express*: call `app.disable('x-powered-by')` and, for the `Server` header if set by a reverse-proxy, handle it at the proxy layer. Use the `helmet` package (`app.use(helmet())`) which removes `X-Powered-By`; remove `Server` at the nginx/load-balancer layer.
- For *Cloudflare (any stack)*: Rules > Transform Rules > Modify Response Header > Add Rule > Remove header named `Server`. No server access required.
- For *AWS CloudFront*: use a CloudFront Function or Lambda@Edge on the `viewer-response` event to delete the `Server` header from the response before it reaches the client.
- Verify: `curl -I https://yourdomain.com` — `Server` header should be absent or generic.
How to fix info disclosure server on WordPress.org
- The fix is at the web server layer, not inside WordPress core or a theme.
- For Apache: add `Header unset Server` to your `.htaccess` or virtual host config (requires `mod_headers`). For nginx: add `server_tokens off;` to your `nginx.conf` server block.
- Use the 'HTTP Headers' plugin (Settings → HTTP Headers → Response Headers) to remove the `Server` header without editing server config files directly.
- Verify with browser DevTools (F12 → Network → any request → Response Headers) that `Server` is absent or shows no version string.
How to fix info disclosure server on Magento Open Source
- Same web-server-level fix as Adobe Commerce: for nginx add `server_tokens off;`, for Apache add `ServerTokens Prod` and `ServerSignature Off` to the server config.
- If hosted on a shared host with cPanel: log in to cPanel → File Manager → edit `.htaccess` in the site root → add `Header unset Server` (requires `mod_headers` to be enabled by your host).
- Alternatively, install a WAF or reverse proxy (e.g., Cloudflare free tier) in front of your Magento store and configure it to strip the `Server` header.
- Verify with `curl -I https://yourstore.com`.
How to fix info disclosure server on PrestaShop
- PrestaShop is self-hosted — apply the fix at the web server level, not within PrestaShop's admin.
- For Apache: add `ServerTokens Prod` and `ServerSignature Off` to `httpd.conf` or the `.htaccess` file in the PrestaShop root.
- For nginx: add `server_tokens off;` to the nginx server block for your PrestaShop site, then reload nginx.
- Verify with `curl -I https://yourstore.com` — `Server` should be absent or show only `Apache` or `nginx` with no version number.
How to fix info disclosure server on OpenCart
- OpenCart is self-hosted — the `Server` header is controlled by the web server, not OpenCart itself.
- For Apache hosting: edit `.htaccess` or `httpd.conf` — add `ServerTokens Prod` and `ServerSignature Off`, then restart Apache.
- For nginx: add `server_tokens off;` to your nginx config, then reload.
- Verify with browser DevTools or `curl -I https://yourstore.com`.
Does your site have this issue?
Run a free SEOLZ scan to find info disclosure server — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Info disclosure server?
Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.
Why does info disclosure server matter?
Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.
How do I fix info disclosure server?
Remove or suppress the HTTP `Server` response header so your web server no longer advertises its software name and version number to the public internet.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP