How to fix info disclosure x powered by on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce runs on your own or managed infrastructure (Apache/Nginx + PHP), giving you full control.
2. For Nginx: open your store's server block config (e.g. /etc/nginx/sites-available/your-store.conf) and add 'more_clear_headers X-Powered-By;' inside the server {} or location {} block. Reload Nginx.
3. For Apache: open .htaccess or your VirtualHost config and add: 'Header unset X-Powered-By' and 'Header always unset X-Powered-By'. Ensure mod_headers is enabled (a2enmod headers).
4. To suppress at the PHP level: edit pub/index.php or create app/bootstrap.php customization and add header_remove('X-Powered-By'); at the very top, before any output.
5. Alternatively, use the Magento 2 module 'Magento_Framework' custom plugin to intercept responses and strip the header via a before/after plugin on \Magento\Framework\App\Response\Http.
6. Flush caches (bin/magento cache:flush) and verify via DevTools.

What is info disclosure x powered by?

Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a set of invisible "response headers" alongside the visible page content. One of these, called X-Powered-By, often reveals exactly what software is running behind the scenes — for example "WP Engine", "PHP/8.1.12", or "Express". This header is not required for your site to work; it exists purely as a default that most web frameworks and hosting platforms add automatically. You can safely remove it or replace it with a meaningless placeholder.

Exposing your technology stack is a gift to attackers. When a scanner sees "WP Engine" or "PHP/8.1.2" in the X-Powered-By header, it immediately knows which known vulnerabilities to try — dramatically lowering the effort needed to compromise your store, steal customer data, or inject malware. This falls squarely under OWASP A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Beyond security, a breach that exposes customer payment or personal data creates legal liability under GDPR, CCPA, and PCI-DSS. Removing this header takes minutes and eliminates one of the easiest reconnaissance signals you hand to bad actors for free.

See the complete Info disclosure x powered by guide for every platform and the full background.