Hide PHP version headers

Hiding detailed PHP and server version headers makes it harder for attackers to match known exploits to your stack. This pairs with keeping PHP updated.

Security Ninja includes a test for detailed PHP version info in response headers. See PHP version detail exposure.

Pro one-click fix

1. Go to Security Ninja → Fixes.
2. Enable Hide PHP Version (removes the X-Powered-By response header).
3. Re-run the related security test.

The Pro toggle targets X-Powered-By. A verbose Server header still needs host or web-server configuration.

Manual: Apache (.htaccess)

<IfModule mod_headers.c>
	Header unset X-Powered-By
	Header unset Server
</IfModule>

Also set expose_php = Off in PHP configuration when you can.

Manual: Nginx

Exact directives depend on your build. Many hosts use the headers-more module:

more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';

Ask your host if those directives are not available.

Related: Security Fixes, PHP version update.