Info disclosure x powered by
Quick winRemove or suppress the X-Powered-By HTTP response header so your server stops advertising which technology stack, hosting platform, or software version powers your store.
What it is
Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a set of invisible "response headers" alongside the visible page content. One of these, called X-Powered-By, often reveals exactly what software is running behind the scenes — for example "WP Engine", "PHP/8.1.12", or "Express". This header is not required for your site to work; it exists purely as a default that most web frameworks and hosting platforms add automatically. You can safely remove it or replace it with a meaningless placeholder.
Why it matters
Exposing your technology stack is a gift to attackers. When a scanner sees "WP Engine" or "PHP/8.1.2" in the X-Powered-By header, it immediately knows which known vulnerabilities to try — dramatically lowering the effort needed to compromise your store, steal customer data, or inject malware. This falls squarely under OWASP A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Beyond security, a breach that exposes customer payment or personal data creates legal liability under GDPR, CCPA, and PCI-DSS. Removing this header takes minutes and eliminates one of the easiest reconnaissance signals you hand to bad actors for free.
How to fix it
- Confirm the header exists: open your browser's DevTools (F12), load any page of your store, go to Network → click the first document request → Headers tab, and look for 'X-Powered-By' in the Response Headers section.
- Identify where the header is being set: it may come from your hosting platform (e.g. WP Engine, Kinsta), your web server (Nginx, Apache), your application framework (PHP, Node/Express), or a plugin/middleware layer — you may need to suppress it at more than one level.
- Suppress the header at the server/hosting layer using the platform-specific steps below (e.g. add an Nginx directive, an Apache header rule, or use your host's admin panel).
- If a CMS plugin or framework is also setting it independently, install or configure the appropriate plugin/module to remove it at the application layer as well.
- Optionally replace the header with a non-informative decoy value (e.g. 'X-Powered-By: ☕') so frameworks that require it to exist still compile, but no real information is leaked.
- Verify the fix: re-check DevTools or use a free online header checker (e.g. securityheaders.com) — the X-Powered-By header should be absent or show only the placeholder value.
Fix it on your platform
Pick your platform for the exact steps.
How to fix info disclosure x powered by on Shopify
- Shopify's infrastructure manages all server-level response headers; store owners cannot directly modify X-Powered-By headers.
- Shopify does not expose an X-Powered-By header by default on its standard storefronts — if a scanner flagged one, it likely originated from a third-party app proxy or a custom Hydrogen/headless deployment.
- For Hydrogen (headless) deployments on Oxygen: open your Hydrogen app's server entry file (e.g. server.ts), find the Response object, and explicitly delete the header: response.headers.delete('X-Powered-By');
- For third-party app embeds adding the header, contact that app's support to request they suppress it on their proxy responses.
How to fix info disclosure x powered by on Shopify Plus
- Same as Shopify above — the core Shopify platform controls server headers.
- For custom Hydrogen/Oxygen storefronts, edit server.ts and add response.headers.delete('X-Powered-By'); before returning any response.
- For third-party middleware or app proxies (common with Shopify Plus custom integrations), work with your developer to add the suppression at the proxy layer.
How to fix info disclosure x powered by on WooCommerce
- WooCommerce runs on WordPress + PHP on your own or managed hosting, so the header can come from PHP, Apache/Nginx, or the host itself.
- Install the free plugin 'HTTP Headers' (by Caspar Hübinger) or 'Security Headers' from WordPress.org: Dashboard → Plugins → Add New → search 'HTTP Headers' → Install → Activate.
- In the plugin settings, add a rule to remove X-Powered-By (most plugins provide a toggle or a 'Remove' action for this specific header).
- Alternatively, if you have server access, add the Apache/Nginx snippet shown in the code examples below to your .htaccess (Apache) or server block (Nginx).
- To suppress it at the PHP level, add header_remove('X-Powered-By'); to your theme's functions.php or a must-use plugin (wp-content/mu-plugins/remove-headers.php).
- Verify via DevTools or an online header checker.
How to fix info disclosure x powered by on WordPress.org
- Same approach as WooCommerce above — install 'HTTP Headers' or 'Security Headers' plugin, or edit .htaccess / Nginx config at the server level.
- To suppress via PHP: add header_remove('X-Powered-By'); in wp-content/mu-plugins/remove-headers.php (create the file if it doesn't exist). This fires before any theme or plugin can set the header.
- For Apache hosts: add 'Header unset X-Powered-By' and 'Header always unset X-Powered-By' to your .htaccess file (requires mod_headers).
- For Nginx hosts: add 'more_clear_headers X-Powered-By;' in the server {} block (requires headers_more module) or manage via your host's control panel.
How to fix info disclosure x powered by on BigCommerce
- BigCommerce is a fully hosted SaaS platform; server-level response headers are managed by BigCommerce infrastructure and are not directly editable by store owners.
- BigCommerce does not emit a meaningful X-Powered-By header by default on standard storefronts.
- If you are running a headless BigCommerce storefront (e.g. on Next.js/Vercel or a custom Node server), open your server middleware and add: res.removeHeader('X-Powered-By'); in your Express/Next.js config (see code snippets below).
- For Next.js specifically, add the header removal in next.config.js using the headers() function.
- Contact BigCommerce support if a non-headless storefront is emitting this header unexpectedly.
How to fix info disclosure x powered by on Adobe Commerce (Magento)
- Adobe Commerce runs on your own or managed infrastructure (Apache/Nginx + PHP), giving you full control.
- For Nginx: open your store's server block config (e.g. /etc/nginx/sites-available/your-store.conf) and add 'more_clear_headers X-Powered-By;' inside the server {} or location {} block. Reload Nginx.
- For Apache: open .htaccess or your VirtualHost config and add: 'Header unset X-Powered-By' and 'Header always unset X-Powered-By'. Ensure mod_headers is enabled (a2enmod headers).
- To suppress at the PHP level: edit pub/index.php or create app/bootstrap.php customization and add header_remove('X-Powered-By'); at the very top, before any output.
- Alternatively, use the Magento 2 module 'Magento_Framework' custom plugin to intercept responses and strip the header via a before/after plugin on \Magento\Framework\App\Response\Http.
- Flush caches (bin/magento cache:flush) and verify via DevTools.
How to fix info disclosure x powered by on Magento Open Source
- Follow the same steps as Adobe Commerce (Magento) above — the server stack and file locations are identical.
How to fix info disclosure x powered by on Wix
- Wix is a fully hosted platform; server response headers are controlled by Wix infrastructure and cannot be modified by store owners through the standard editor.
- Wix does not expose X-Powered-By headers on standard storefronts.
- If you are using Wix Headless (Wix's headless commerce offering) with a custom server, suppress the header in your server middleware as shown in the Node.js/Express code snippet below.
- If a scanner flagged this on your Wix site, it may have originated from an embedded third-party widget or script — contact that vendor to request they suppress the header on their end.
How to fix info disclosure x powered by on Wix Studio
- Same as Wix above — Wix Studio is hosted infrastructure with no direct server-header control for standard sites.
- For Wix Studio sites using custom backend code (Velo/backend modules), you cannot set or remove transport-layer headers from within Velo — this is a platform-level concern.
- Contact Wix support if you believe the platform itself is leaking X-Powered-By.
How to fix info disclosure x powered by on Squarespace
- Squarespace is a fully hosted SaaS platform; store owners cannot modify server response headers directly.
- Squarespace does not expose an X-Powered-By header on standard storefronts.
- If a third-party integration or code injection block is adding this header, remove or update that integration.
- Contact Squarespace support if the platform itself is emitting the header unexpectedly.
How to fix info disclosure x powered by on Squarespace Commerce
- Same as Squarespace above — no direct header control available to store owners.
- Review any custom code injected via Settings → Advanced → Code Injection for scripts that might be loading iframes or proxies emitting this header.
How to fix info disclosure x powered by on Webflow
- Webflow is a hosted platform; standard Webflow sites do not allow direct server response header customization.
- Webflow does not emit X-Powered-By on standard hosted projects.
- If you are exporting Webflow code and self-hosting it on a Node/Express or Apache/Nginx server, apply the server-level fix (see code snippets below) on your own infrastructure.
- For Webflow Hosting, if a scanner flags this, contact Webflow support — it may be a CDN/edge configuration issue on their side.
How to fix info disclosure x powered by on Webflow Commerce
- Same as Webflow above. Webflow Commerce store owners do not have server-header access on the hosted platform.
- Focus on reviewing any embedded third-party payment or app integrations that might proxy requests and add their own X-Powered-By header.
How to fix info disclosure x powered by on Headless / Custom (I build in code)
- For Express.js (Node): use app.disable('x-powered-by'); in your app setup, or install the 'helmet' package (npm install helmet) and add app.use(helmet()); — helmet disables X-Powered-By by default.
- For Next.js: add a headers() function in next.config.js that returns { key: 'X-Powered-By', value: '' } with a remove action, or use a custom server with Express + helmet.
- For Apache: add 'Header unset X-Powered-By' in .htaccess or VirtualHost config (mod_headers must be enabled).
- For Nginx: add 'more_clear_headers X-Powered-By;' in the server {} block (requires ngx_headers_more module), or add 'fastcgi_hide_header X-Powered-By;' for PHP-FPM setups.
- For PHP: call header_remove('X-Powered-By'); at the top of your entry-point file (index.php) and set 'expose_php = Off' in php.ini.
- Verify by checking response headers in DevTools or curl -I https://yourdomain.com.
How to fix info disclosure x powered by on PrestaShop
- PrestaShop runs on PHP/Apache or Nginx — suppress the header at the PHP and server layers.
- Add header_remove('X-Powered-By'); at the top of index.php in your PrestaShop root directory.
- For Apache: add 'Header unset X-Powered-By' to your .htaccess file.
- For Nginx: add 'fastcgi_hide_header X-Powered-By;' inside the location ~ \.php$ block of your server config.
- Also set expose_php = Off in your php.ini to prevent PHP version leakage via this header.
How to fix info disclosure x powered by on OpenCart
- OpenCart runs on PHP; the X-Powered-By header typically comes from PHP itself.
- Add header_remove('X-Powered-By'); at the very top of your index.php (OpenCart root) and admin/index.php.
- Set expose_php = Off in php.ini (usually at /etc/php/[version]/apache2/php.ini or equivalent).
- For Apache: add 'Header unset X-Powered-By' to your .htaccess.
- Restart Apache/PHP-FPM and verify with DevTools.
How to fix info disclosure x powered by on Ghost
- Ghost runs on Node.js/Express. Add helmet middleware to your Ghost installation.
- Ghost does not officially support modifying its core Express app, but you can configure a reverse proxy (Nginx) in front of Ghost to strip the header.
- In your Nginx config for Ghost, add 'more_clear_headers X-Powered-By;' inside the server block, or use 'proxy_hide_header X-Powered-By;' when proxying to Ghost.
- Restart Nginx and verify.
How to fix info disclosure x powered by on Next.js
- In next.config.js, add a custom headers() export that removes X-Powered-By, or use the built-in poweredByHeader: false option.
- Set module.exports = { poweredByHeader: false }; in next.config.js — Next.js will stop sending 'X-Powered-By: Next.js' in responses.
- If using a custom Express server, also add app.disable('x-powered-by'); and install helmet (npm install helmet) with app.use(helmet());
- Redeploy and verify via curl -I or DevTools.
How to fix info disclosure x powered by on Nuxt.js
- For Nuxt 3 (Nitro server): create or edit server/middleware/headers.ts and export default defineEventHandler((event) => { removeResponseHeader(event, 'x-powered-by'); });
- For Nuxt 2 with Express: add app.disable('x-powered-by'); in your server middleware and use the helmet package.
- Redeploy and verify.
How to fix info disclosure x powered by on Drupal
- In your sites/default/settings.php or a custom module's hook_boot(), call `header_remove('X-Powered-By');` or use `drupal_add_http_header('X-Powered-By', '');`
- Install the 'Security Kit' (seckit) module from drupal.org: Admin → Configuration → System → Security Kit — it provides options to strip information-disclosure headers.
- For Apache: Add `Header unset X-Powered-By` to your .htaccess or VirtualHost config.
- For Nginx: Add `more_clear_headers 'X-Powered-By';` to the server block.
How to fix info disclosure x powered by on Cloudflare (as CDN/proxy — applicable to any platform above)
- If your store's traffic passes through Cloudflare, you can strip the X-Powered-By header using a Cloudflare Transform Rule. Go to Cloudflare Dashboard → your domain → Rules → Transform Rules → Modify Response Header.
- Click 'Create rule', set Field = 'X-Powered-By', Operation = 'Remove', apply to all incoming requests, and save.
- This works regardless of your underlying platform and provides a network-level safety net.
Does your site have this issue?
Run a free SEOLZ scan to find info disclosure x powered by — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Info disclosure x powered by?
Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a set of invisible "response headers" alongside the visible page content. One of these, called X-Powered-By, often reveals exactly what software is running behind the scenes — for example "WP Engine", "PHP/8.1.12", or "Express". This header is not required for your site to work; it exists purely as a default that most web frameworks and hosting platforms add automatically. You can safely remove it or replace it with a meaningless placeholder.
Why does info disclosure x powered by matter?
Exposing your technology stack is a gift to attackers. When a scanner sees "WP Engine" or "PHP/8.1.2" in the X-Powered-By header, it immediately knows which known vulnerabilities to try — dramatically lowering the effort needed to compromise your store, steal customer data, or inject malware. This falls squarely under OWASP A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Beyond security, a breach that exposes customer payment or personal data creates legal liability under GDPR, CCPA, and PCI-DSS. Removing this header takes minutes and eliminates one of the easiest reconnaissance signals you hand to bad actors for free.
How do I fix info disclosure x powered by?
Remove or suppress the X-Powered-By HTTP response header so your server stops advertising which technology stack, hosting platform, or software version powers your store.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP
- Website security — MDN