This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Software currency
What do server headers reveal about your website's software?
Server headers can name the software delivering your website, along with its version number — the web server or the programming environment in use, say. Your server sends these headers invisibly with every response; anyone can query them without you noticing. The Software Currency audit area reports when version numbers are in them, since they make it easier for attackers to identify the software.
Every server response carries invisible headers
When a browser requests a page on your website, the server responds with the content — and with a set of headers the visitor never sees. They handle technical matters like caching or character encoding. Some of them are pure self-disclosure: the "Server" header often names the web server software, "X-Powered-By" the programming environment — by default, often including the version number. This audit area reads the headers of the page it requests anyway, and reports every one that contains a version number, with the exact line as evidence. No additional access to your server takes place for this.
Version numbers in the header are pure reconnaissance aid for attackers
Anyone wanting to attack a website first finds out what software runs there. If the headers hand over the versions for free, this effort disappears — matching them to known weaknesses becomes simple research. Here too, the check draws a clean line: a visible version header proves visibility, not vulnerability. Whether the named software version actually has an exploitable hole, the finding doesn't say, and the check doesn't examine that either. In the assessment, the hidden server signature counts for 20 of 100 points — a small building block, but an easy one to collect, since switching it off usually costs no functionality.
The hosting provider or agency switches off the signature
The headers' self-disclosure can be suppressed in the server configuration, or shortened to just the product name with no version. On rented web space, the hosting provider handles this — a short request to support is often enough. If your agency runs the server, this step belongs in their maintenance routine. Websites on website-builder platforms are outside your influence; there, the provider is responsible for server maintenance as a whole. What matters is keeping the perspective right: hiding the signature is hygiene, not a shield. The actual security work is the ongoing update of the server software — it just happens invisibly, while the signature is the most visible thing a server gives away.
- Ask your hosting provider or agency to switch off version values in the response headers.
- Ask what server software delivers your website, and who's responsible for updating it.
- After every server move or major update, have it checked whether the headers name versions again — default settings like to come back.
- Put responsibility in writing: server maintenance belongs in a maintenance contract, not a verbal aside.
FAQ
What is an HTTP header?
A header that the server and browser exchange alongside the content on every page request. Headers handle technical processes like caching, redirects, or character encoding. Visitors never see them, but any program can read them. Some headers contain self-disclosure from the server — that's exactly where software names and version numbers can appear.
What does "X-Powered-By" mean?
This header names the programming environment a website is built with, by default often including the version number. For running the website, the value has no use — no browser needs it. It can be switched off in the server configuration, with no change to the website's behaviour.
Is a visible server header a security hole?
No. It's a reconnaissance aid: attackers learn, with no effort of their own, which software is answering in which version, and can specifically search for matching weaknesses. Whether such a weakness actually exists on your system, the header doesn't say — and the check assesses only visibility, never the vulnerability of your installation.
Can I switch off server headers myself?
That depends on your hosting. On rented web space, the hosting provider handles it on request; on your own server, your agency or administrator does it via the server configuration. On website-builder platforms, only the provider decides on server settings. The change is small and usually costs no functionality — it belongs in every maintenance routine.