How to fix info disclosure server on Wix

Steps for Wix

1. Wix is a fully managed SaaS platform — `Server` header configuration is controlled by Wix infrastructure and cannot be changed from the Wix Editor or dashboard.
2. If your audit flags a `Server` header on a Wix site, this is a platform-level behaviour; submit a feedback/support request to Wix via the Help Center.
3. As a workaround for compliance, document in your audit evidence that the server layer is managed by Wix (a SOC 2 certified vendor) and is outside merchant control.
4. Premium Wix sites connected to a custom domain can optionally route through Cloudflare as a proxy — in your domain registrar, point the domain's nameservers (or A record) to Cloudflare with proxying enabled, then use a Transform Rule to strip the `Server` header.

What is info disclosure server?

Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.

Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.

See the complete Info disclosure server guide for every platform and the full background.