Security · WordPress
How to stop advertising software versions in headers in WordPress
This does not create a vulnerability, it removes the work of finding one — a scanner can match your exact version against known CVEs instead of probing. Suppressing the header is usually one config line.
The fix for WordPress
13x detects your framework from the response and hands you this version rather than the generic one — below 50% confidence it hedges and gives you the generic one instead.
WordPress advertises its version in a meta tag and in headers:
// functions.php
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');Also remove ?ver= query strings from asset URLs, which leak plugin versions, and check your server config for X-Powered-By.
On a different stack? The general version of this fix explains what 13x checks and why it matters, without assuming a framework.
Check your WordPress site
113 deterministic checks against your live URL, in about 30 seconds. Framework detected from the response, so every fix comes back in the form your stack actually uses.
No signup. Results in 30 seconds.