Header Info Disclosure Scanner

How this check works

Scanaris reads the headers of your page's main response and looks at two of them. If X-Powered-By is present with any value (for example Express, PHP/8.2.12 or Next.js), it opens a low-severity finding. If Server is present and its value contains a version number (something like nginx/1.18.0 or Apache/2.4.57), it opens another. A plain Server: nginx or Server: cloudflare is not flagged: saying which server you use is not a problem; saying exactly which version is.

Why it matters

Neither header does anything for the user or the browser. They exist out of habit. What they do is save work for anyone looking for a vulnerability: with PHP/7.4.3 or Apache/2.4.49 in the response, the attacker does not have to guess anything, they go straight to the list of known flaws for that version and try the ones with a public exploit. It is a low-severity finding because on its own it opens no door; but it is one of the easiest to close, and mass scanners filter their targets by exactly these headers.

How to remove them, by stack

• Express: app.disable('x-powered-by') when creating the app, or use helmet(), which removes it along with other hardening.
• Next.js: sends X-Powered-By: Next.js by default. In next.config.js, poweredByHeader: false.
• PHP: in php.ini, expose_php = Off. On shared hosting this can usually be changed from the panel or with a .user.ini.
• ASP.NET: in web.config, inside customHeaders, <remove name="X-Powered-By" />, and in IIS also disable the X-AspNet-Version header with enableVersionHeader="false".
• nginx: server_tokens off; in the http block. It still says "nginx", but without a version.
• Apache: ServerTokens Prod and ServerSignature Off in the main configuration. With Prod the header becomes plain Apache.
• Vercel, Netlify, Cloudflare Pages: send no version in Server. If you see X-Powered-By there, it comes from your framework (Next.js or Express), not the platform.

If you have a proxy or CDN in front (Cloudflare, a load balancer), check the public response: sometimes the proxy replaces the Server header and the problem disappears on its own, but X-Powered-By usually passes through untouched.

Check it is fixed

curl -sI https://yourdomain.com | grep -iE "^(server|x-powered-by):"

Ideally X-Powered-By does not appear and Server, if present, carries no number. Also try an API route or an error page (a URL that does not exist): errors are sometimes generated in another layer that adds the header back.

Frequently asked questions

Hiding the version does not fix the vulnerability. What is the point?

Not being on the first page of results for someone hunting victims. You are right that the real fix is updating: hiding the version is the complement, not the substitute. Both together take five minutes.

My host does not let me touch the server configuration.

Then at least remove X-Powered-By from your code or your .htaccess (Header unset X-Powered-By) and ask the host to hide the version. The other security headers, the ones you should have, are covered by the security headers check.

Why is "Server: cloudflare" not flagged?

Because it reveals nothing usable: no version and no specific software behind it. What this check looks for is information that shortens the path to an exploit. Which headers are worth having and which are just noise is covered in HTTP security headers explained for humans.