Server reveals its software version

SeverityLow

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_version_leak

Short answer

Your home page's Server, X-Powered-By or a similar header includes a version number, for example Apache/2.4.41 or PHP/8.1.2. Automated scanners match these against vulnerability lists and pick sites running old versions. Hiding the number is a small fix; keeping the software updated is the real protection. There is no ranking effect.

Why it matters

Mass-exploitation bots do not study your site; they sweep the internet for a version string with a known exploit and attack every match. A visible PHP/7.4.33 also tells them the runtime is past end of life. Removing the number fixes no vulnerability, but it takes you off the cheapest target lists and stops advertising update gaps.

The severity is Low because the same information can often be inferred in other ways. Search engines ignore these headers.

How Glimana detects it

Glimana reads the response headers of your HTTPS home page and checks Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator. A header is flagged when its value contains a version number (digits with a dot, such as 2.4). A product name without a version, such as Server: nginx or Server: cloudflare, passes. The problem is Low.

How to fix it

Watch out

ServerTokens is only allowed in the main server configuration; putting it in .htaccess causes a 500 error for the whole site. expose_php can likewise only be changed in php.ini or your host's PHP settings, not with ini_set(). Behind Cloudflare the Server header is replaced, but X-Powered-By passes through unless you remove it.

Find the finding in Glimana. Open Security; this check is in the Information leaks group, with the evidence from the last scan under its title. The same problem is listed under Issues › Server reveals its software version.
Apply the fix on your platform.

ApacheNginxPHP / ASP.NETCloudflare

In the main configuration (apache2.conf, httpd.conf or the virtual host): ServerTokens Prod and ServerSignature Off, then reload Apache. On shared hosting where you only have .htaccess, you can still remove the PHP header with Header always unset X-Powered-By and Header unset X-Powered-By (which one works depends on how PHP runs).

server_tokens off; in the http block. For PHP via PHP-FPM add fastcgi_hide_header X-Powered-By;; for an application behind proxy_pass, proxy_hide_header X-Powered-By;. Then nginx -t && systemctl reload nginx.

PHP: expose_php = Off in php.ini or in the PHP options of your hosting panel, then restart PHP-FPM. ASP.NET: <httpRuntime enableVersionHeader="false" /> in web.config removes X-AspNet-Version; for MVC add MvcHandler.DisableMvcResponseHeader = true; to Application_Start.

Rules › Settings › Managed Transforms: turn on Remove "X-Powered-By" headers. For any other header create a Response Header Transform Rule (Rules › Overview › Create rule) with the Remove operation. Cloudflare already replaces Server with cloudflare.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After fixing, press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes as soon as the check passes.