This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Response headers: what software the server tells the world about itself
Servers and application frameworks often attach their identifier to every response — server name with version, the programming language in use, the application framework used. The check reads the headers, and reports version values found along with their location.
- This rule hit us too: on the first check run against our own site, the check reported two signatures — the application framework and the application server. Anyone who sells the standard holds themselves to it; both have been switched off since.
- Switching it off happens in two places: in the application itself, and in the server configuration in front of it. Changing only one of the two leaves the other identifier standing.
- As with the other visibility rules: hiding it closes no hole. It just removes the basis for automated matching.
FAQ
Which headers are meant?
Mainly the server identifier and the application framework identifier. The report quotes the found line verbatim, so the location is unambiguous.
Does removing the identifier harm operations?
No. The values serve no technical function; they're pure self-disclosure.