Many web servers include their exact software name and version number in every response (a Server header like nginx/1.18.0), which hands attackers a shortcut — they can look up known vulnerabilities for that specific version instead of probing blind.
Server and X-Powered-By headers hand attackers a head start — "Apache/2.4.49" or "PHP/7.2.3" tells them exactly which known vulnerabilities to try first. This information has no benefit to legitimate visitors.
Server version disclosure suppression addresses the same underlying reconnaissance-prevention principle discussed regarding exposed server software generally, applied specifically to the version information commonly included in HTTP response headers by default across many common web server configurations.
The genuine distinction between this check and general server version exposure is specificity — this focuses particularly on the version-string information commonly appearing in the Server header of HTTP responses, a specific, common default disclosure point that many server administrators never explicitly review or suppress.
Attackers conducting reconnaissance against a target routinely check this specific header as one of their first, lowest-effort information-gathering steps, since it's directly visible in any basic HTTP request with no special tools or techniques required — suppressing this information removes this particular free reconnaissance opportunity.
This represents genuinely straightforward server configuration work — most common web server software provides a documented configuration option for suppressing or generalizing this version disclosure, making this a low-effort addition to your broader security hardening that closes off one specific, commonly-overlooked information leak.
Your response headers no longer reveal specific software version numbers.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →