How to fix info disclosure server on WooCommerce

Steps for WooCommerce

1. WooCommerce runs on WordPress, so the fix lives at the web-server level of your hosting account — not inside the WooCommerce or WordPress admin.
2. For *nginx hosting*: SSH into your server, open `/etc/nginx/nginx.conf` (or the server block file for your site, often in `/etc/nginx/sites-available/`). Inside the `http {}` block add `server_tokens off;`. Save and run `sudo nginx -t && sudo systemctl reload nginx`.
3. For *Apache hosting*: Open or create a `.htaccess` file in your WordPress root (`public_html/`) and add `ServerTokens Prod` and `ServerSignature Off` — note these directives require `AllowOverride All` or must go in `httpd.conf`; on shared hosting you may need to ask your host to set them.
4. For *cPanel/shared hosting*: Contact your hosting provider and request they set `ServerTokens Prod` at the Apache level, or install the *'Headers and Options'* or *'LiteSpeed Cache'* plugin (LiteSpeed Cache > Toolbox > Config tab has a 'Hide Server Signature' option if on LiteSpeed servers).
5. Alternatively, install the WordPress plugin *'HTTP Headers'* (by Fer Urbina) or *'Security Headers'* (by Patrick Labbé) — these allow you to add a custom `Server` header value or remove it via PHP's `header_remove('Server')` hook, which works for PHP-generated responses but may not affect static assets served directly by the web server.
6. Verify with `curl -I https://yourdomain.com` — the `Server` line should be absent or show only `nginx` or `Apache` with no version.

What is info disclosure server?

Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.

Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.

See the complete Info disclosure server guide for every platform and the full background.