Server software not advertised

What this means

Passing means no Server or X-Powered-By header on your response names a product version. Failing means one does, such as a framework name followed by a release number. A bare product name without a version does not fail, because it tells an attacker nothing they could not guess.

How we test it

We read the headers on the home page response and look at server and x-powered-by. No header, or a header with no version number, passes. A header naming software without a version warns. A header carrying a version string fails. We never scan ports or probe the server; we read what it tells every visitor.

Why it matters

Version strings help attackers pick exploits. A header that says which framework and which release built the page turns a general search into a specific one, with the known weaknesses of that release listed in public. This is an information finding, not a breach, but it is the easiest tell that a site was never looked at before launch.

The fix

Remove the X-Powered-By header where your framework sets it and do not add a Server header of your own; the kit's header templates in vercel.json and next.config.ts add nothing that names software. Confirm with curl -sI https://YOUR_DOMAIN | grep -iE '^(server|x-powered-by)', expected no line that contains a version number. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI https://YOUR_DOMAIN | grep -iE '^(server|x-powered-by)' and show me the output, or tell me it is empty.
Run the same against https://YOUR_DOMAIN/ANY_INNER_PAGE and show me the output.
Tell me which header carries a version string, and quote it.
Tell me where that header is set: the framework default, a custom server, or the host.
List what it would take to remove it, and stop there.
Run: curl -sI https://YOUR_DOMAIN | grep -iE '^(server|x-powered-by)' | grep -cE '[0-9]+\.[0-9]+' and show me the output. Expected on a passing site: 0.