How to fix info disclosure server on Shopify

Steps for Shopify

1. Shopify's infrastructure is fully managed — the `Server` header is controlled by Shopify, not by theme code or admin settings.
2. As a merchant you cannot modify server-level headers directly; Shopify already suppresses detailed version information.
3. If a scanner still flags a `Server` header value on your Shopify storefront, open a support ticket with Shopify Plus support (for Plus merchants) referencing the specific header value, or route all traffic through Cloudflare (see Cloudflare steps below) to strip the header at the CDN edge before it reaches end users.

What is info disclosure server?

Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.

Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.

See the complete Info disclosure server guide for every platform and the full background.