Checks
Server version leaks
Checks response headers for leaked server software or version details, information that helps an attacker target known vulnerabilities in your exact stack.
What this check looks for
This check inspects the homepage's Server header for any digit (a version number), and separately checks for the presence of X-Powered-By, X-AspNet-Version, or X-AspNetMvc-Version headers at all. Any of these found warns, quoting the leaked header value. No version-revealing headers passes.
Why it matters
A header like Server: nginx/1.18.0 or X-Powered-By: PHP/7.4.3 tells an attacker precisely which software and version your server is running, which lets them skip straight to checking for known, published vulnerabilities in that exact version instead of probing blindly — it's a small piece of reconnaissance that meaningfully lowers the effort required to find an exploitable weak point. Removing these headers doesn't make your stack more secure by itself, but it removes a free hint that otherwise makes an attacker's job easier for no benefit to you. This is a general security-hygiene signal rather than an SEO or AI-visibility one, in the same category as the other header checks here.
How to fix it
Strip or override version-revealing headers at the server or reverse-proxy layer:
# nginx: hide the version number, but leave the Server header present
server_tokens off;# Remove framework-specific headers if your framework adds them by default
# (e.g. disable X-Powered-By in Express, ASP.NET, etc. via framework config)Check both your application server and any reverse proxy or CDN in front of it, since either layer can reintroduce these headers independently.
See how your site scores on this check