Removing X-Powered-By
PhpHttp HeadersPhp Problem Overview
-
How can I remove X-Powered-By header in PHP? I am on an Apache Server and I use php 5.21. I can't use the header_remove function in php as it's not supported by 5.21. I used Header unset X-Powered-By, it worked on my local machine, but not on my production server.
-
If php doesn't support header_remove() for ver < 5.3, is there an alternative?
Php Solutions
Solution 1 - Php
I think that is controlled by the expose_php setting in PHP.ini:
expose_php = off
> Decides whether PHP may expose the fact that it is installed on the server (e.g. by adding its signature to the Web server header). It is no security threat in any way, but it makes it possible to determine whether you use PHP on your server or not.
There is no direct security risk, but as David C notes, exposing an outdated (and possibly vulnerable) version of PHP may be an invitation for people to try and attack it.
Solution 2 - Php
header_remove("X-Powered-By");
Solution 3 - Php
If you cannot disable the expose_php directive to mute PHP’s talkativeness (requires access to the php.ini), you could use Apache’s Header directive to remove the header field:
Header unset X-Powered-By
Solution 4 - Php
if (function_exists('header_remove')) {
header_remove('X-Powered-By'); // PHP 5.3+
} else {
@ini_set('expose_php', 'off');
}
Solution 5 - Php
If you have an access to php.ini, set expose_php = Off.
Solution 6 - Php
Try adding a header() call before sending headers, like:
header('X-Powered-By: Our company\'s development team');
regardless of the expose_php setting in php.ini
Solution 7 - Php
If you use FastCGI try:
fastcgi_hide_header X-Powered-By;
Solution 8 - Php
This solution worked for me :)
Please add below line in the script and check.
Ngnix / Apache etc level settings might not be required.
header("Server:");