Server Signature Test
The Server Signature Test inspects the HTTP response headers from any URL for Server, X-Powered-By, X-AspNet-Version and similar disclosures that reveal the underlying server software and version.
- Results in seconds
- Pass / fail + fix guidance
- No account required
The Server Signature Test inspects the HTTP response headers from any URL for Server, X-Powered-By, X-AspNet-Version and similar disclosures that reveal the underlying server software and version. While not a critical vulnerability on its own, broadcasting "I am running Apache 2.4.49" tells attackers exactly which CVEs to try first. Hiding or genericising these headers is a basic hardening step that reduces your attack surface at zero functional cost.
What This Tool Checks
- Server response header (Apache/2.4.x, Nginx/1.x, Microsoft-IIS/x)
- X-Powered-By header (PHP/x, ASP.NET version)
- X-AspNet-Version, X-AspNetMvc-Version
- X-Generator header (CMS-specific)
- Granular version numbers vs major-version only
Why It Matters for SEO
Server fingerprinting is the first step of most automated vulnerability scans. Telling attackers your exact version of Apache, Nginx, PHP or ASP.NET lets them target known CVEs efficiently. Removing or genericising these headers does not stop a determined attacker but raises the bar enough to deflect most automated scanners. The fix is a few lines of server config and has no functional downside.
How to Fix It
In Apache, set ServerTokens Prod and ServerSignature Off. In Nginx, set server_tokens off. In PHP, set expose_php = Off in php.ini. Remove or genericise X-Powered-By and X-Generator at the CDN or origin. Re-test until only generic or absent headers remain.
How It Works
We fetch the URL and parse every response header. Each disclosure is reported with the security implication and the server / CDN config snippet to remove or genericise it.
Common Mistakes to Avoid
- Default server install exposing full version (Apache/2.4.49 (Ubuntu))
- X-Powered-By: PHP/8.0.4 disclosed by default in php.ini
- X-Generator: WordPress 6.2 left enabled (telegraphs the CMS)
- Hiding the server header but forgetting X-Powered-By
- Treating header hardening as low priority because it is not a direct vulnerability
Quick Checklist
- Server header reduced to product name only or absent
- No X-Powered-By header
- No X-AspNet-Version header
- No X-Generator header
- Re-tested after server / framework upgrades
Put your whole site on autopilot — SEO and AI search
PositionMySite monitors every signal on this page across your entire website 24/7 — plus keyword rankings, competitor moves and AI-search readiness (llms.txt, schema, ChatGPT & Gemini visibility). When something breaks, you know before Google does.
Every feature unlocked · No commitment · Cancel anytimeFrequently Asked Questions
Not on its own, but it makes targeted attacks much easier. Most automated vulnerability scanners check the server header first to decide which exploit to attempt.
Add `server_tokens off;` to the http block in nginx.conf and reload. For complete removal, use the headers-more module or a CDN that strips headers.
Set `expose_php = Off` in php.ini and restart PHP-FPM. The X-Powered-By header will no longer be added to responses.
No directly. It is a security hygiene step that reduces attack surface without any functional or SEO trade-off.
Hide identifying headers (Server version, X-Powered-By). Keep functional headers (Content-Type, Cache-Control, security headers like CSP and HSTS) — those serve real purposes.