Server header exposes the stack

The fix for your stack

// Removes X-Powered-By. A Server header set by your host (e.g. Vercel) cannot be removed from your app.
// next.config.ts
import type { NextConfig } from "next";

const nextConfig: NextConfig = { poweredByHeader: false };

export default nextConfig;

Why it matters, and how much

Attackers scan the internet for specific software versions that have published vulnerabilities. A header that says PHP/7.4.3 or nginx/1.18.0 lets them find your site without any probing and tells them which exploit to try. Hiding the version does not make the software safer, and it is no substitute for updating it, but it removes a free signal and is a common line in security questionnaires.

The weight is small for that reason. Naming the product alone, such as Server: nginx, reveals much less than naming a version, and many sites on managed platforms cannot change the header at all. Skewcheck keeps this check light on purpose and avoids blaming you for something your host decides.

How Skewcheck detects it

Skewcheck reads the server and x-powered-by response headers. If neither is sent, the check passes. If the only header is a server value that a hosting platform sets itself, for example Vercel, Cloudflare, Netlify, GitHub Pages, Amazon S3, Framer or Webflow, it passes and notes that the value belongs to your host. Otherwise the check warns with low severity and removes 1 point from the score, and the message adds a note when the server header contains a version number.

An X-Powered-By header always counts, because it comes from your application or framework, not from the host. The list of host names is a short fixed one, so a platform missing from it can look like a warning that you cannot fix; if your host sets the header and you cannot change it, you can accept the single point.

curl -sI https://example.com | grep -iE '^(server|x-powered-by):'

Removing the headers

On nginx, server_tokens off removes the version, and a proxy_hide_header line hides X-Powered-By from an app behind the proxy. On Apache, ServerTokens Prod and ServerSignature Off shorten the Server value to just Apache (the version goes, but a bare product name still warns for 1 point), and ServerTokens belongs in the main server configuration, not in .htaccess. For PHP, set expose_php to Off in php.ini. A Next.js app sets poweredByHeader to false in its config. Only removing the headers entirely gives a clean pass: a bare Server: nginx or Server: Apache still warns for 1 point, which is safe to accept if your server or host cannot remove it, and any X-Powered-By header warns until it is gone. The tabs above give each of these, along with the cases where the host owns the header and nothing can be changed.

After changing it, restart the server or redeploy, then check the live response with the command above and confirm that both headers are gone (or at least the version hidden) on a few different paths, since an error page or a static file can be served by a different layer from the page itself. The best protection remains keeping the software updated, so treat this change as housekeeping and make sure the underlying version is current.

Before and after

server: Apache/2.4.41 (Ubuntu)
x-powered-by: PHP/7.4.3

# version hidden; a bare product name still warns for 1 point
server: Apache