Checks / Links, canonical and speed
Server version is public
The Server or X-Powered-By header names the software and its exact version, which tells an attacker which known flaws to try. It does not affect search or AI answers.
server_version_disclosed · Links, canonical and speed · Notice
What triggers it
A Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version or X-Generator header on your home page carries a version number such as nginx/1.18.0. A bare name such as nginx does not count.
What to change
Hide the version: nginx `server_tokens off;`, Apache `ServerTokens Prod`, PHP `expose_php = Off`.
Example
Server setting:
# nginx: server_tokens off;
# Apache: ServerTokens Prod
# PHP (php.ini): expose_php = OffHow to confirm the fix
- Run curl -sI https://example.com/ : the Server header shows no version number
- Run a new crawl
How common it is
We have not measured how common this is on a sample of sites. Counts appear here when a study covers it.
About this check
| Check ID | server_version_disclosed |
|---|---|
| Report section | Links, canonical and speed |
| Severity | Notice |
| How it is decided | Measured: read directly from the page or the server's response. |
| Added | Before 19 Oct 2026 (versions 1 and 2), or a site-wide check with no version date yet |
| Status | Measured in every report |
| Report gives the code | Yes, one block for the site |
Related checks
- Render-blocking scripts and styles
- Security headers missing
- Sitemap has no useful last-modified dates
- Sitemap dates are older than the pages' own
See whether it applies to your site
Paste your address and we crawl up to 10 pages and show every issue we find, with its fix. No account, no card.
Every plan crawls up to its page limit and lists these checks with the fix: plans.
How an audit works: method