snag.page

Every check ยท Headers

Software versions

headers/versions

What it checks

Server, X-Powered-By and similar headers, for version numbers.

Why it matters

A version number tells an attacker which known flaws to try.

How to fix it

  1. Turn version numbers off: server_tokens off in nginx, ServerTokens Prod in Apache, expose_php = Off for PHP.
  2. Keep the software up to date, whatever the headers say.

Check a site for this and everything else: snag.page. More on headers: Bot challenge Content-Security-Policy Framing nosniff Referrer policy End-of-life software CORS Permissions-Policy Cross-Origin-Opener-Policy