Server version visible

Why it matters

Bots scan the web for servers with a version that has a known hole. Leaving out the version number does not fix a hole, but it makes your site harder to find in such a search.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the Server and X-Powered-By headers of the homepage and reports them when they include a version number.

Common causes

• The server settings show the version by default
• PHP adds X-Powered-By with its version
• The host never changed the default settings

How to fix it

1. Ask the host to hide the version number, with server_tokens off and expose_php off.
2. On your own server, change those settings yourself.
3. Keep updating the software. Hiding the version is no replacement.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Your server tells which software and version it runs". When everything is in order, the report says: "The server does not reveal its software version".