Page reveals the exact CMS version

SeverityInfo

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_generator_leak

Short answer

Your pages contain <meta name="generator"> with a version number, such as WordPress 6.5.3 or WooCommerce 9.1.2. Bots use it to find sites running a release with a known vulnerability. Removing the version is a one-line change, but keeping the CMS and plugins updated matters far more, because the version can usually be read from file URLs anyway. There is no ranking effect.

Why it matters

The tag is a free label for automated scanners: a site that announces an outdated release lands on the target list for that release's exploit, and the tag also tells attackers which plugins to look at. Hiding it does not make an old version safe. WordPress, for example, also shows its version in the ?ver= query strings of scripts and stylesheets, which Glimana itself uses for its outdated-software check.

Because hiding brings only a small gain, this is Info. Google ignores the generator tag.

How Glimana detects it

Glimana reads the HTML of your home page and up to two other pages and collects every <meta name="generator"> tag (sites often have several: the CMS, a page builder, a shop plugin). It is flagged (Info) when any of them contains a version number (digits with a dot), and the issue shows that tag. Generator tags without a version, such as Drupal 10, pass.

How to fix it

Watch out

Removing the tag is not a substitute for updating. Plugins that promise to hide your WordPress version by stripping ?ver= from file URLs can stop browsers from loading fresh files after an update; that is not needed to pass this check.

Find the finding in Glimana. Open Security; this check is in the Information leaks group, with the evidence from the last scan under its title. The same problem is listed under Issues › Page reveals the exact CMS version.
Apply the fix on your platform.

WordPressPlugins and page buildersOther platforms

Add to your child theme's functions.php or to a small must-use plugin in wp-content/mu-plugins/: add_filter('the_generator', '__return_empty_string');. This removes the core tag from pages and feeds, and also the WooCommerce tag, which is added through the same filter. Many security plugins have a Hide WordPress version switch that does the same.

Some page builders and slider plugins print their own generator tag (for example Powered by Slider Revolution with a version). The issue shows the exact text; look in that plugin's settings for an option to remove it, or ask its developer which remove_action call removes it. Keep these plugins updated: they are frequent targets.

Hugo: set disableHugoGeneratorInject = true in the site configuration. Other static site generators and CMSs usually print the tag from the theme's head template; delete the line or remove the version from it. Check again after the next platform update, which may restore it.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After fixing, press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes as soon as the check passes.