Security · fix guide

How to hide your server and PHP version

Your website's headers announce the exact software and version it runs. Here's how to switch that off on PHP, Apache, nginx, IIS and Cloudflare, and what to ask your host.

Published October 22, 2026Updated October 22, 2026By Remidiy

Short answer: if your site's Server or X-Powered-By header shows a version number (for example PHP/7.4.33 or Apache/2.4.41), turn it off: expose_php = Off for PHP, ServerTokens Prod for Apache, server_tokens off for nginx. On shared hosting it's one setting or one support ticket.

Hiding the number doesn't fix old software. If the version it showed is out of date, update that first; hiding it only stops you advertising it.

Every time someone loads your website, your server sends a set of headers along with the page. Two of them, Server and X-Powered-By, often name the exact software and version the site runs on. Anyone can read them in a second, including the automated tools attackers use to find sites running versions with known holes.

Server or X-Powered-By header reveals a version

Fix soon Shown in the checker's Security tab as “X-Powered-By header reveals …” or “Server header reveals …”.

The checker flags this when either header contains something that looks like a version number, such as Server: Apache/2.4.41 (Ubuntu), Server: nginx/1.18.0 or X-Powered-By: PHP/7.4.33. A bare name like Server: nginx or Server: cloudflare is fine and isn't flagged.

Why it matters

A version number is a shortcut for an attacker. Public vulnerability databases list every known flaw by product and version, so PHP/7.4.33 tells someone that the server runs a PHP branch that stopped getting official security releases in November 2022, and is affected by flaws such as PHP2Shell. Automated scanners search the web for exactly these strings.

Hiding the version is defence in depth, not a cure. It won't stop a determined attacker, but it takes you off the cheap lists, and it costs nothing. The real fix for an old version is to update it.

How to fix it

Find the software named in the header, then use the matching fix. If you're on shared or managed hosting and can't edit server files, send your host the ticket text at the end of this section.

PHP (X-Powered-By: PHP/…)

Set expose_php = Off in php.ini. This stops PHP adding the X-Powered-By header (PHP manual: expose_php).
In cPanel, open MultiPHP INI Editor, choose your domain, and switch expose_php to Disabled. Plesk has the same setting under PHP Settings.
Restart PHP-FPM or Apache if you edited the file by hand; managed panels do it for you.

; php.ini
expose_php = Off

Apache (Server: Apache/…)

Add these two lines to the main server configuration (for example /etc/apache2/conf-enabled/security.conf on Ubuntu) and reload Apache. ServerTokens can't be set in .htaccess, so on shared hosting this one is the host's job (Apache docs: ServerTokens).

ServerTokens Prod
ServerSignature Off

If you can only use .htaccess, you can still remove the PHP header with mod_headers:

<IfModule mod_headers.c>
  Header always unset X-Powered-By
</IfModule>

nginx (Server: nginx/…)

Add server_tokens off; inside the http block of nginx.conf, then test and reload with nginx -t && systemctl reload nginx. The header then reads just nginx (nginx docs: server_tokens).

http {
    server_tokens off;
}

IIS (Server: Microsoft-IIS/…)

On IIS 10 and later, set removeServerHeader="true" on requestFiltering in web.config, and remove the ASP.NET X-Powered-By custom header in IIS Manager under HTTP Response Headers (Microsoft docs: requestFiltering).

Behind Cloudflare

Cloudflare replaces the Server header with cloudflare, but passes X-Powered-By through. A Response Header Transform Rule that removes X-Powered-By hides it for every page without touching the server (Cloudflare docs).

What to send your host

“Our site's response headers show the server software version (the Server and X-Powered-By headers). Please turn version disclosure off: expose_php = Off for PHP, and ServerTokens Prod / server_tokens off for the web server. Also, which PHP version is the site on, and is it a currently supported release?”

How to check it's fixed

Run curl -sI https://yourbusiness.com in a terminal and read the Server and X-Powered-By lines; neither should contain a number. Or run the website checker again: the finding disappears from the Security tab. Browsers can cache headers, so test in a private window if the old value persists.

Sources

PHP manual: expose_php
Apache HTTP Server: ServerTokens directive
nginx: server_tokens directive
OWASP HTTP Headers Cheat Sheet (recommends removing or minimising Server and X-Powered-By)
MDN: the Server header

Common questions

Is it dangerous if my website shows its PHP version?

On its own it isn't a hole, but it tells attackers which known flaws to try. If the version shown is old (anything before PHP 8.2, or a release below the latest fix), the real risk is the old software itself, so update it. Check with the PHP vulnerability checker.

How do I remove the X-Powered-By header?

For PHP, set expose_php = Off in php.ini (cPanel: MultiPHP INI Editor). On Apache you can also add Header always unset X-Powered-By to .htaccess, and behind Cloudflare a Response Header Transform Rule can remove it.

Can I hide the Server header completely?

Usually you can only shorten it. Apache's ServerTokens Prod leaves just "Apache" and nginx's server_tokens off leaves just "nginx". Removing the name entirely needs an extra module or a proxy such as Cloudflare, and the name alone is harmless.

Does hiding the version make my site secure?

No. It's a small layer of defence that keeps you off automated lists. Keeping PHP, the web server and your CMS updated is what actually closes known holes.

Why does the checker still show the old version after I changed the setting?

The change may not have been applied yet (PHP-FPM or the web server needs a reload), a caching layer may still serve the old headers, or a second layer such as a CDN or a reverse proxy adds its own header. Check again with curl -sI in a few minutes.

Check the rest of your site. The website checker reads every header a browser sees, plus your certificate, speed, SEO and email setup, and links each problem to a guide like this one. If the version it found is PHP, the PHP vulnerability checker tells you whether it's affected by PHP2Shell.