Hide X-Powered-by (Nginx)

So is there any way to hide X-Powered-By on Nginx?

4

7 Answers

proxy_hide_header X-Powered-By;
5

x-powered-by is given by the module, for instance php fastcgi module offers to set expose_php=Off in php.ini

4

If you use NGINX with FastCGI you should use:

fastcgi_hide_header X-Powered-By;

Try to use the more_clear_headers directive from the nginx's HttpHeadersMoreModule which can allow you to declare:

more_clear_headers 'X-Powered-By';

which should do just what you want.

1

Nginx

  1. Open this file

    $ sudo vi /etc/nginx/nginx.conf

  2. Find the HTTP section, this section defines configurations for Nginx's HttpCoreModule. Add the below directive:

    $ server_tokens off;

This will configure Nginx not send any version numbers in the HTTP header.

(Removing the server name is possible, however, since Nginx modules cannot be dynamically loaded, you would need to recompile Nginx from source with the HttpHeadersMoreModule Nginx module.)

  1. Reload Nginx configuration To apply the change, reload Nginx service:

    $ sudo service nginx reload

Marcus Vance

Marcus Vance

Cybersecurity & Digital Privacy Researcher

Marcus Vance is a cybersecurity auditor and technology writer dedicated to educating the public about online safety, data privacy regulations, enterprise security, and emerging cyber threats.