How to fix info disclosure server on Webflow

Steps for Webflow

1. Webflow hosting is fully managed — merchants cannot access the underlying server configuration.
2. Webflow serves sites through its own CDN (powered by Fastly) and does not expose exploitable server version strings by design.
3. If you use a custom domain with Cloudflare in front of Webflow: Cloudflare dashboard → your domain → Rules → Transform Rules → Modify Response Header → add a Remove rule for the `Server` header.
4. For Webflow Enterprise with a custom reverse proxy, work with your infrastructure team to strip the `Server` header at the proxy layer.

## Apache (.htaccess or httpd.conf)
ServerTokens Prod
ServerSignature Off
Header unset Server

## nginx (nginx.conf — inside http{} or server{} block)
server_tokens off;

## IIS (web.config — inside <system.webServer>)
<security>
  <requestFiltering removeServerHeader="true" />
</security>

## Cloudflare Transform Rule (via dashboard UI)
# Rules → Transform Rules → Modify Response Header
# Operation: Remove
# Header name: server

What is info disclosure server?

Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a response that often includes a `Server` header — a small piece of text that announces exactly what software is running, right down to the version number (e.g., `Microsoft-IIS/10.0`, `Apache/2.4.51`, or `nginx/1.18.0`). This is called information disclosure. Removing or blanking that header is a simple configuration change that stops your store from broadcasting its technology stack to anyone who looks.

Attackers routinely scan millions of sites looking for specific server versions with known security vulnerabilities — your `Server` header is a free map that tells them exactly which exploits to try. Exposing it significantly lowers the effort required to target your store, putting customer data, payment information, and your reputation at risk. OWASP lists this pattern under A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Removing the header doesn't fix every vulnerability, but it removes the signpost that guides attackers to them, and it is expected by PCI DSS compliance auditors.

See the complete Info disclosure server guide for every platform and the full background.