How to fix info disclosure server on Shopify Plus
Remove or suppress the HTTP `Server` response header so your web server no longer advertises its software name and version number to the public internet.
Steps for Shopify Plus
- Same as Shopify — server infrastructure is managed by Shopify.
- For compliance requirements, use Cloudflare as a reverse-proxy in front of your Shopify Plus storefront: point your domain's DNS to Cloudflare (orange-cloud proxy enabled), then add a Cloudflare Transform Rule to remove the `Server` response header (see Cloudflare steps).
- Contact your Shopify Plus launch engineer or support team to document that the header is platform-controlled for any PCI/compliance evidence package.
What is info disclosure server?
Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.
Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.
See the complete Info disclosure server guide for every platform and the full background.
Not sure if your Shopify Plus store has this?
Run a free SEOLZ scan — we’ll find info disclosure server and every other issue across your whole site.
Scan my site free