Server headers reveal software versions
A Server or X-Powered-By header names the software and its version, which tells attackers which known bugs to try.
- Severity
- Info
- Who can exploit it
- Nobody directly; it saves an attacker a step
- Found by
- PatchLabs Live posture: your home page’s response headers
- Lab proof
- Not lab-proven: read from your home page’s response
What it is
Some servers announce themselves in every response: Server: nginx/1.18.0, X-Powered-By: PHP/8.1.2. PL-035 means a header like that carries a version number. On its own it exposes nothing, but it turns “is this server out of date?” into a lookup: anyone can match the version against published advisories without sending a single probe.
A bare product name such as Server: Vercel or Server: cloudflare is not reported; the finding is about versions.
Why AI builders produce it
These headers are on by default in many servers and frameworks, and nobody asks a generator to turn them off. They show up most on apps that moved from a managed host to a self-hosted server or container.
What we see
A synthetic example for app.example.com, shortened. Not taken from any real site.
$ curl -sI https://app.example.com
HTTP/2 200
server: nginx/1.18.0 (Ubuntu)
x-powered-by: PHP/8.1.2Check it yourself
curl -sI https://your-app.com | grep -iE '^(server|x-powered-by|x-aspnet-version|x-generator):'The fix
Turn the header off where it is added. If you see a version, also check that it is current: hiding an old version helps a little, upgrading it helps a lot.
Next.js
// next.config.js
module.exports = {
poweredByHeader: false, // drops X-Powered-By: Next.js
}Express
const app = express()
app.disable('x-powered-by')nginx
# nginx.conf, inside http { }
server_tokens off; # Server: nginx, without the versionCloudflare
For a proxied site, a Response Header Transform Rule (Rules → Transform Rules) can Remove X-Powered-By before responses reach visitors. That hides it; the fix at the source above is still better.
Live posture findings come with the header or setting to change. PatchLabs never changes your hosting or your repo.
How PatchLabs finds it
[LOAD] https://app.example.com/ → 200 server nginx/1.18.0 x-powered-by PHP/8.1.2 info: versions visible
Live posture reads the Server and X-Powered-By style headers from the final response of its one page load and reports them when they contain a version number. It doesn’t look the versions up or probe for the bugs they might have.
When the pattern is intended
Harmless on a managed platform that names itself without a version. On your own server there is no reason to publish the version.
Why it’s rated info
Information: nothing is exposed and nothing can be exploited through the header itself. It costs no points in the Live posture grade, and is listed because the fix takes one line.
Related findings
Dependency with a known vulnerability
A package version in your lockfile matches a published advisory in the OSV database.
PL-032No X-Content-Type-Options: nosniff
Browsers may guess a file’s type from its contents, so an uploaded “image” can be run as a script or page.
PL-036No Referrer-Policy
Your page sends no Referrer-Policy, so the browser’s default decides how much of your URLs other sites see.
Guides
Free check
Does your site have PL-035?
Type your site’s address. The free headers check loads your public home page once, like any visitor, and grades HTTPS, the certificate, security headers, cookie flags and mixed content. No sign-up, and the result isn’t stored.
Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.