Server Signature Test
The Server Signature Test inspects the HTTP response headers from any URL for Server, X-Powered-By, X-AspNet-Version and similar disclosures that reveal the underlying server software and version. While not a critical vulnerability on its own, broadcasting "I am running Apache 2.4.49" tells attackers exactly which CVEs to try first. Hiding or genericising these headers is a basic hardening step that reduces your attack surface at zero functional cost.
What This Tool Checks
- Server response header (Apache/2.4.x, Nginx/1.x, Microsoft-IIS/x)
- X-Powered-By header (PHP/x, ASP.NET version)
- X-AspNet-Version, X-AspNetMvc-Version
- X-Generator header (CMS-specific)
- Granular version numbers vs major-version only
Why It Matters for SEO
Server fingerprinting is the first step of most automated vulnerability scans. Telling attackers your exact version of Apache, Nginx, PHP or ASP.NET lets them target known CVEs efficiently. Removing or genericising these headers does not stop a determined attacker but raises the bar enough to deflect most automated scanners. The fix is a few lines of server config and has no functional downside.
How to Fix It
In Apache, set ServerTokens Prod and ServerSignature Off. In Nginx, set server_tokens off. In PHP, set expose_php = Off in php.ini. Remove or genericise X-Powered-By and X-Generator at the CDN or origin. Re-test until only generic or absent headers remain.
How It Works
We fetch the URL and parse every response header. Each disclosure is reported with the security implication and the server / CDN config snippet to remove or genericise it.
Common Mistakes to Avoid
- Default server install exposing full version (Apache/2.4.49 (Ubuntu))
- X-Powered-By: PHP/8.0.4 disclosed by default in php.ini
- X-Generator: WordPress 6.2 left enabled (telegraphs the CMS)
- Hiding the server header but forgetting X-Powered-By
- Treating header hardening as low priority because it is not a direct vulnerability
Quick Checklist
- Server header reduced to product name only or absent
- No X-Powered-By header
- No X-AspNet-Version header
- No X-Generator header
- Re-tested after server / framework upgrades