Info disclosure x powered by

What it is

Every time someone visits your store, your web server sends back a set of "headers" — invisible metadata that browsers and tools can read. One of these, X-Powered-By, often announces exactly what software is running your site (e.g., "WP Engine", "PHP/8.1", "Express"). This header serves no useful purpose for your customers but acts like a neon sign telling attackers which known vulnerabilities to target. Removing or masking it is a simple hardening step that reduces your visible attack surface.

Why it matters

Attackers routinely scan millions of sites for this header and then cross-reference the disclosed technology with published CVE vulnerability databases — meaning an exposed X-Powered-By header can make your store a faster, easier target for automated exploits. While removing it doesn't fix underlying vulnerabilities, it raises the effort required to fingerprint your stack and is a baseline expectation in security audits and PCI-DSS compliance reviews. Failing this check can flag your store in penetration tests, risk assessments, and payment-processor security questionnaires, potentially affecting your ability to process cards. It is specifically called out under OWASP A05:2021 – Security Misconfiguration as an information-disclosure risk.

How to fix it

1. Audit your current headers by visiting your site URL in a tool like https://securityheaders.com or using browser DevTools (Network tab → click any request → inspect Response Headers) to confirm the X-Powered-By header is present.
2. Identify where the header is being set: it may come from your hosting platform/CDN, your web server (Apache/Nginx), a PHP runtime, or a Node.js framework — sometimes multiple layers send it.
3. Remove or suppress the header at the highest relevant layer (hosting control panel, server config, or application code) — see platform-specific steps below.
4. If you cannot fully remove it (e.g., a managed host sets it), replace its value with a generic or empty string so it reveals nothing meaningful.
5. Re-test with DevTools or securityheaders.com to confirm the header no longer appears (or now shows a non-informative value) in server responses.
6. Repeat the check after any platform upgrade or plugin update, as updates can re-introduce the header.

# Nginx — strip X-Powered-By in server block
more_clear_headers 'X-Powered-By';

# Apache .htaccess — unset header
Header unset X-Powered-By

# PHP — suppress PHP version header
expose_php = Off          # php.ini
header_remove('X-Powered-By');  # PHP code

# Next.js — next.config.js
module.exports = {
  poweredByHeader: false,
};

Fix it on your platform

Pick your platform for the exact steps.

Frequently asked questions

Authoritative references

• OWASP Top Ten — OWASP
• OWASP Cheat Sheet Series — OWASP
• Secure Headers Project — OWASP