How to fix info disclosure x powered by on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. For Express.js (Node): use app.disable('x-powered-by'); in your app setup, or install the 'helmet' package (npm install helmet) and add app.use(helmet()); — helmet disables X-Powered-By by default.
2. For Next.js: add a headers() function in next.config.js that returns { key: 'X-Powered-By', value: '' } with a remove action, or use a custom server with Express + helmet.
3. For Apache: add 'Header unset X-Powered-By' in .htaccess or VirtualHost config (mod_headers must be enabled).
4. For Nginx: add 'more_clear_headers X-Powered-By;' in the server {} block (requires ngx_headers_more module), or add 'fastcgi_hide_header X-Powered-By;' for PHP-FPM setups.
5. For PHP: call header_remove('X-Powered-By'); at the top of your entry-point file (index.php) and set 'expose_php = Off' in php.ini.
6. Verify by checking response headers in DevTools or curl -I https://yourdomain.com.

What is info disclosure x powered by?

Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a set of invisible "response headers" alongside the visible page content. One of these, called X-Powered-By, often reveals exactly what software is running behind the scenes — for example "WP Engine", "PHP/8.1.12", or "Express". This header is not required for your site to work; it exists purely as a default that most web frameworks and hosting platforms add automatically. You can safely remove it or replace it with a meaningless placeholder.

Exposing your technology stack is a gift to attackers. When a scanner sees "WP Engine" or "PHP/8.1.2" in the X-Powered-By header, it immediately knows which known vulnerabilities to try — dramatically lowering the effort needed to compromise your store, steal customer data, or inject malware. This falls squarely under OWASP A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Beyond security, a breach that exposes customer payment or personal data creates legal liability under GDPR, CCPA, and PCI-DSS. Removing this header takes minutes and eliminates one of the easiest reconnaissance signals you hand to bad actors for free.

See the complete Info disclosure x powered by guide for every platform and the full background.