X-Powered-By

response headersecurity

Advertises the framework behind a site — Express, PHP, ASP.NET. Remove it.

Many frameworks add X-Powered-By by default: Express, Next.js, PHP/8.3.4, ASP.NET. Browsers and clients don't use it; it only tells scanners which exploits to try. Removing it won't stop a determined attacker, but it costs nothing and keeps your site out of searches for vulnerable versions.

Syntax

X-Powered-By: <framework>[/<version>]

Defined in MDN — X-Powered-By (non-standard).

Examples

X-Powered-By: Express

Express's default

X-Powered-By: PHP/8.3.4

PHP with expose_php on — the exact version

Good to know

The Server header leaks similar information; nginx hides its version with server_tokens off;.
Removing the header doesn't fix anything by itself — keep the framework patched.

Further reading: Security headers checklist · Security headers generator

How to remove X-Powered-By

Express

app.disable("x-powered-by");

Next.js (next.config.js)

module.exports = {
  poweredByHeader: false,
};

PHP (php.ini)

expose_php = Off

ASP.NET (web.config)

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

nginx (in front of an app)

proxy_hide_header X-Powered-By;    # proxied apps
fastcgi_hide_header X-Powered-By;  # PHP-FPM

Apache

Header always unset X-Powered-By
Header unset X-Powered-By

Check it

Fetch only the response headers and filter for X-Powered-By. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^x-powered-by:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Is X-Powered-By a security risk?

Not directly — it reveals information rather than opening a hole. But version numbers make it trivial to match a site to known vulnerabilities, so there's no reason to send it.