When your web server responds to a request, it often includes a header revealing exactly what software and version it's running:

Server: Apache/2.4.49 (Unix)
X-Powered-By: PHP/7.4.3

This is called server version disclosure. It gives attackers a precise roadmap to known vulnerabilities in your stack.

Why it matters

Software vulnerabilities are catalogued in public databases (CVEs). If an attacker knows you're running Apache 2.4.49, they can look up every known CVE for that version in seconds. Apache 2.4.49, for example, had a critical path traversal vulnerability (CVE-2021-41773) actively exploited in the wild. Without version disclosure, an attacker has to guess. With it, they go straight to the exploit.

What gets disclosed

  • Web server headers — Apache, Nginx, IIS version strings
  • X-Powered-By headers — PHP, ASP.NET version numbers
  • Error pages — default error pages often include version info
  • CMS meta tags — WordPress adds a generator tag with its exact version number

How to fix it

Apache: Set ServerTokens Prod and ServerSignature Off.

Nginx: Set server_tokens off.

PHP: Set expose_php = Off in php.ini.

WordPress: Remove the generator meta tag. Most security plugins handle this automatically.

threatprobe.app's free scan checks response headers and flags any that expose software or version information.

Check what your server is revealing →