Checks · HDR-006

HDR-006 · Server or version banner leak

Why it matters

A version banner tells an attacker which bugs to try. It does not protect you to hide it, but it removes a hint.

How we detect it

X-Powered-By is present, or Server includes a version number.

How we fix it

Turn the banner off in the framework or proxy.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP