Matan · Security · Exposure

Version disclosure (Security)

Server and X-Powered-By headers that include versions help attackers pick exploits.

Pass condition in our engine: No versioned Server header and no X-Powered-By.

This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.

1. Problem description

We flag Server values that contain digits and any X-Powered-By. Hiding versions is security through obscurity — still worth doing, but not a substitute for patching.

2. Most common causes

  • nginx/1.18.0 default.
  • X-Powered-By: Express or PHP/8.x.

3. How to fix it

  1. server_tokens off; remove X-Powered-By in the app.
  2. Generalise Server to a generic name if your host allows it.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free website audit

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Analyze My Website — FreeView sample report