Skip to content

Security

How to stop advertising software versions in headers

This does not create a vulnerability, it removes the work of finding one — a scanner can match your exact version against known CVEs instead of probing. Suppressing the header is usually one config line.

What 13x checks

This is rule security.version-disclosure in the public registry: No exact software versions in headers. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
3 of the readiness score
Scope
Runs on every audited page
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Headers advertising exact versions: .

nginx code
# nginx
server_tokens off;
proxy_hide_header X-Powered-By;
js code
// Express
app.disable("x-powered-by");

This creates no vulnerability by itself — it removes the work of finding one. A scanner can match your exact version against published CVEs instead of probing for behaviour. Suppressing it is one line, so there is no reason to publish it.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks