topic
Verified 2026-09-18

Server Information Disclosure

Response fields and error pages can reveal implementation details useful to attackers.

Remove X-Powered-By, minimize Server, avoid stack traces in bodies, and treat disclosure reduction as defense in depth rather than a substitute for patching and hardening.

httpsecurityprivacyheader

Reference (http)

Server: webserver
X-Powered-By: framework

Remove X-Powered-By, minimize Server, avoid stack traces in bodies, and treat disclosure reduction as defense in depth rather than a substitute for patching and hardening.

Common mistakes

  • Exposing framework versions in every response while relying on a hidden banner elsewhere.

Sources

Permalink: https://merginit.com/reference/http/server-disclosure