PHP adds an X-Powered-By header with its exact version unless expose_php is turned off. That tells anyone, including automated scanners, which vulnerabilities to try. Set expose_php = Off in the server's PHP configuration or hosting panel, remove the header at the web server or CDN if needed, and keep patching: hiding the version reduces targeting but doesn't fix an outdated PHP.
This guide covers check 08: Observability and deployment in the Zenveus Production Readiness Standard.
For builders
Your server may be announcing exactly which PHP version it runs in every response. That makes it easy for automated tools to pick which known bugs to try. Turning the announcement off takes one setting, but it is a small extra layer: the real protection is keeping PHP up to date.
A scoped repair request
Use this prompt in Lovable, Cursor, Replit, or Claude Code with the relevant server files available.
Check whether my site discloses its PHP or server version. Give me read-only commands to inspect response headers on a normal page and an error page. Then show the smallest configuration change to stop X-Powered-By and version strings on error pages, for my setup (php.ini, Apache or LiteSpeed .htaccess, Nginx, or CDN), and how to verify it. Do not change other headers or security settings.The same failure may appear as
Find the failure layer
Each check removes a class of causes. Keep the first failing result, its timestamp, and the production log beside it.
Request a normal page and an error page, and look for X-Powered-By, Server and framework-specific headers.
curl -sI https://example.com/ | grep -iE 'x-powered-by|^server'
curl -sI https://example.com/this-page-does-not-exist | grep -iE 'x-powered-by|^server'Check whether you can edit php.ini directly or through your hosting panel's PHP options. The PHP manual lists expose_php as a php.ini-only setting, so ini_set(), .htaccess and .user.ini can't change it.
Compare the disclosed version with the latest security release for its branch before you hide it.
Ranked diagnosis
Many installations ship with expose_php enabled.
The web server, proxy or CDN passes backend headers through unchanged.
Debug or default error pages print versions even when the header is removed.
Step-by-step repair
Change php.ini where your host allows it (directly or through the hosting panel), or add a header rule at the web server or CDN.
Production safety ruleNever disable access controls, expose service keys, or add wildcard CORS as a routine shortcut.
Set expose_php = Off in php.ini, directly or through your hosting panel's PHP options, then restart PHP so every worker picks it up.
If you can't change PHP settings, remove X-Powered-By at the web server, reverse proxy or CDN response rules.
Turn off display_errors in production and serve custom error pages that don't print versions or stack traces.
Implementation example
; php.ini (directly or via your hosting panel)
expose_php = Off
# Apache or LiteSpeed, if php.ini is out of reach
Header always unset X-Powered-By
# Nginx in front of PHP-FPM
fastcgi_hide_header X-Powered-By;Restart PHP after changing php.ini. The Apache directive needs mod_headers; on managed hosting, check which method your host supports.
Prove the repair
Run these checks with synthetic data in your test environment, then repeat the relevant acceptance checks after deployment.
When the built-in AI fix makes it worse
Pause generated changes, restore a known working branch, and capture one failing request with its logs. Change one layer and rerun the allowed and denied checks before proceeding.
Engineering handoff
We trace one production request through the complete path, isolate the failing boundary, and leave behind evidence your team can repeat.
Version and technology disclosure across pages, errors and APIs.
Whether the disclosed versions are current and supported.
Production error pages and logging that don't leak internals.
Header rules at the web server, proxy and CDN.
Typical repair pattern
Normal and error responses carry no X-Powered-By header, error pages show no versions, and the PHP build itself is current.
Before the next release
Clear answers
No. It removes an easy hint for attackers, but scanners can still try known exploits. Keeping PHP patched is the actual protection.
No. The PHP manual lists expose_php as a php.ini-only setting. Change it in php.ini or your hosting panel's PHP options, or remove the header at the web server or CDN instead.
Reducing it to a generic value is reasonable. Some hosts and CDNs set it themselves, so you may only be able to change it at the edge.
Run the verification checks on this page from outside the server. The X-Powered-By header should be gone from normal and error responses.
Related symptoms
Official documentation and library references
Free next step
The free tool helps you inspect this symptom. Its result does not establish whether the whole app is production ready.
Take it further
This fix solves one symptom. A guided self-assessment walks you through the rest of the app, one session at a time, and ends with a report and a ranked fix list you can act on or hand to a developer.
Every fix breaks something else? Freeze what works, trace bugs to a few root causes, add guardrails and leave with a ranked plan.
See the sprint Preparing to launch · $997-Day Launch Readiness SprintTest the running system against the nine-area Production Readiness Standard and reach a Ready, Conditional release or Hold decision with a ranked fix list.
See the sprintPlanning more than one stage? Founder Bundles combine the guided products from $149 and save up to $405.
The Verdict
We can see the symptom from here. What we cannot tell you from outside is whether it is contained or structural. A scanner collects evidence. A named senior engineer makes the decision. For $299, a named senior engineer reads your code and signs a written Verdict against the nine checks in the Zenveus Production Readiness Standard. The 48-hour clock begins when the required access and context are available. If the report does not give your developer a list they can act on, you do not pay.
The 48-hour clock starts when the required access and context are available.
If each fix breaks something else, you probably have a few root causes, not dozens of bugs. Find out where you stand.
Free. No email needed. Close this and we won’t show it again during this visit.