How to fix info disclosure x powered by on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. For Nginx: Edit your Magento Nginx server block config (typically at /etc/nginx/sites-available/magento or your server's vhost file). Add `more_clear_headers 'X-Powered-By';` inside the `server {}` block, then run `nginx -t && systemctl reload nginx`.
2. For Apache: Open or create a .htaccess in your Magento web root. Add `Header unset X-Powered-By` (mod_headers must be enabled). Alternatively, set it in your VirtualHost config.
3. For PHP-FPM: Edit php.ini (or a pool .conf file) and set `expose_php = Off` — this prevents PHP from adding its own X-Powered-By value.
4. For Adobe Commerce Cloud (cloud.adobe.com): Add a custom Fastly VCL snippet via Admin → Stores → Configuration → Advanced → System → Full-Page Cache → Fastly Configuration → Custom VCL Snippets, with a `vcl_deliver` subroutine that calls `unset resp.http.X-Powered-By;`.
5. Verify with: `curl -I https://yourstore.com | grep -i powered`

# Nginx — strip X-Powered-By in server block
more_clear_headers 'X-Powered-By';

# Apache .htaccess — unset header
Header unset X-Powered-By

# PHP — suppress PHP version header
expose_php = Off          # php.ini
header_remove('X-Powered-By');  # PHP code

# Next.js — next.config.js
module.exports = {
  poweredByHeader: false,
};

What is info disclosure x powered by?

Every time someone visits your store, your web server sends back a set of "headers" — invisible metadata that browsers and tools can read. One of these, X-Powered-By, often announces exactly what software is running your site (e.g., "WP Engine", "PHP/8.1", "Express"). This header serves no useful purpose for your customers but acts like a neon sign telling attackers which known vulnerabilities to target. Removing or masking it is a simple hardening step that reduces your visible attack surface.

Attackers routinely scan millions of sites for this header and then cross-reference the disclosed technology with published CVE vulnerability databases — meaning an exposed X-Powered-By header can make your store a faster, easier target for automated exploits. While removing it doesn't fix underlying vulnerabilities, it raises the effort required to fingerprint your stack and is a baseline expectation in security audits and PCI-DSS compliance reviews. Failing this check can flag your store in penetration tests, risk assessments, and payment-processor security questionnaires, potentially affecting your ability to process cards. It is specifically called out under OWASP A05:2021 – Security Misconfiguration as an information-disclosure risk.

See the complete Info disclosure x powered by guide for every platform and the full background.