# X-Powered-By Header — Syntax, Values & Examples

> Advertises the framework behind a site — Express, PHP, ASP.NET. Remove it.

Many frameworks add X-Powered-By by default: `Express`, `Next.js`, `PHP/8.3.4`, `ASP.NET`. Browsers and clients don't use it; it only tells scanners which exploits to try. Removing it won't stop a determined attacker, but it costs nothing and keeps your site out of searches for vulnerable versions.

- Type: Response header
- Category: Security
- Defined in: [MDN — X-Powered-By (non-standard)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Powered-By)

## Syntax

```http
X-Powered-By: <framework>[/<version>]
```

## Examples

```http
X-Powered-By: Express
```

Express's default

```http
X-Powered-By: PHP/8.3.4
```

PHP with expose_php on — the exact version

## Good to know

- The `Server` header leaks similar information; nginx hides its version with `server_tokens off;`.
- Removing the header doesn't fix anything by itself — keep the framework patched.

## How to remove X-Powered-By

### Express

```
app.disable("x-powered-by");
```

### Next.js (next.config.js)

```
module.exports = {
  poweredByHeader: false,
};
```

### PHP (php.ini)

```
expose_php = Off
```

### ASP.NET (web.config)

```
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>
```

### nginx (in front of an app)

```
proxy_hide_header X-Powered-By;    # proxied apps
fastcgi_hide_header X-Powered-By;  # PHP-FPM
```

### Apache

```
Header always unset X-Powered-By
Header unset X-Powered-By
```

## Check it

Fetch only the response headers and filter for X-Powered-By. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^x-powered-by:'
```

## FAQ

### Is X-Powered-By a security risk?

Not directly — it reveals information rather than opening a hole. But version numbers make it trivial to match a site to known vulnerabilities, so there's no reason to send it.

## Related headers

- [X-Content-Type-Options](https://www.devkult.com/headers/x-content-type-options.md): With nosniff, stops browsers guessing a response's type, so a text file can't be run as a script.
- [Strict-Transport-Security](https://www.devkult.com/headers/strict-transport-security.md): Tells browsers to use only HTTPS for the site for a set period, blocking downgrade attacks.
- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.

## Further reading

- [Security headers checklist](https://www.devkult.com/blog/security-headers-checklist.md)
- [Security headers generator](https://www.devkult.com/tools/security/security-headers-generator.md)

Open the interactive page: https://www.devkult.com/headers/x-powered-by