Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

X-Powered-By Header Exposed

Your server sends an 'X-Powered-By' header revealing the backend technology and version (e.g., PHP/7.4, Express, ASP.NET).

Risk

This header directly reveals your backend stack. Knowing you run PHP 7.4 tells an attacker to try PHP-specific exploits for that version. Knowing you use Express narrows the attack surface to Node.js vulnerabilities. This information has zero benefit for users and only helps attackers.

Solution

Remove the X-Powered-By header from your server responses. Most frameworks provide a simple way to disable it.

Example

# Express.js
app.disable('x-powered-by');

# PHP (php.ini)
expose_php = Off

Helmet.js - hidePoweredBy

Comments (0)

No messages yet.