How to fix info disclosure x powered by on WooCommerce

Steps for WooCommerce

1. WooCommerce runs on WordPress + PHP on your own or managed hosting, so the header can come from PHP, Apache/Nginx, or the host itself.
2. Install the free plugin 'HTTP Headers' (by Caspar Hübinger) or 'Security Headers' from WordPress.org: Dashboard → Plugins → Add New → search 'HTTP Headers' → Install → Activate.
3. In the plugin settings, add a rule to remove X-Powered-By (most plugins provide a toggle or a 'Remove' action for this specific header).
4. Alternatively, if you have server access, add the Apache/Nginx snippet shown in the code examples below to your .htaccess (Apache) or server block (Nginx).
5. To suppress it at the PHP level, add header_remove('X-Powered-By'); to your theme's functions.php or a must-use plugin (wp-content/mu-plugins/remove-headers.php).
6. Verify via DevTools or an online header checker.

What is info disclosure x powered by?

Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a set of invisible "response headers" alongside the visible page content. One of these, called X-Powered-By, often reveals exactly what software is running behind the scenes — for example "WP Engine", "PHP/8.1.12", or "Express". This header is not required for your site to work; it exists purely as a default that most web frameworks and hosting platforms add automatically. You can safely remove it or replace it with a meaningless placeholder.

Exposing your technology stack is a gift to attackers. When a scanner sees "WP Engine" or "PHP/8.1.2" in the X-Powered-By header, it immediately knows which known vulnerabilities to try — dramatically lowering the effort needed to compromise your store, steal customer data, or inject malware. This falls squarely under OWASP A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Beyond security, a breach that exposes customer payment or personal data creates legal liability under GDPR, CCPA, and PCI-DSS. Removing this header takes minutes and eliminates one of the easiest reconnaissance signals you hand to bad actors for free.

See the complete Info disclosure x powered by guide for every platform and the full background.