This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Response headers: what software the server tells the world about itself
Servers and application frameworks often attach their identifier to every response — server name with version, the programming language in use, the application framework used. The check reads the headers, and reports version values found along with their location.
- This rule hit us too: on the first check run against our own site, the check reported two signatures — the application framework and the application server. Anyone who sells the standard holds themselves to it; both have been switched off since.
- Switching it off happens in two places: in the application itself, and in the server configuration in front of it. Changing only one of the two leaves the other identifier standing.
- As with the other visibility rules: hiding it closes no hole. It just removes the basis for automated matching.
