Go to app
Informational

X-Powered-By

Advertises the application framework or language behind your site: another unnecessary fingerprinting hint for attackers.

What it does

X-Powered-By announces the technology running your application: commonly seen as Express, PHP/8.3.1, or ASP.NET. Many frameworks set it automatically unless you explicitly turn it off.

Why it matters

Like the Server header, this isn't a vulnerability by itself: it's reconnaissance. Knowing you're running a specific PHP version, for instance, lets an attacker immediately check it against known CVEs instead of having to fingerprint your stack through slower, noisier methods.

Disable it entirely. This is a one-line change in most frameworks:

  • PHP: set expose_php = Off in php.ini.
  • Express (Node): app.disable('x-powered-by').
  • ASP.NET: <httpRuntime enableVersionHeader="false" /> in web.config.

As with the Server header, treat this as easy, low-effort hardening rather than a critical gap.