Hide PHP Version HTTP Header: How To

Yes, you can hide the PHP version from the HTTP response header, and doing so is a simple security hardening step that most server administrators recommend. By default, PHP sends a header like X-Powered-By: PHP/8.2.1 with every response; removing or obscuring it prevents attackers from easily targeting known vulnerabilities in that specific version.

What the HTTP Header Reveals

When a web server runs PHP, it can append an X-Powered-By header to every HTTP response. This header typically looks like:

X-Powered-By: PHP/8.2.1

It tells anyone who inspects the response headers—using a browser’s developer tools, a command-line tool like curl -I, or an online header checker—exactly which PHP version is running. While this information is not a vulnerability by itself, it is a piece of reconnaissance data. An attacker who knows you run PHP 7.4.3 can look up the specific exploits and CVEs (Common Vulnerabilities and Exposures) for that version and try them against your site. Hiding the header removes that low-hanging fruit.

Why Hide It? Security Through Obscurity?

Security professionals often say “security through obscurity is no security at all.” That’s true: hiding the header does not patch vulnerabilities. If your PHP version has a critical remote code execution flaw, hiding the header won’t stop an attacker who already knows your stack from other clues (like a specific error page or a known framework).

However, hiding the header is still worthwhile as a defense-in-depth measure. It raises the effort required for automated scanners, which often crawl the web looking for sites with specific vulnerable PHP versions. Those scanners rely on the header to identify targets. By removing it, you make your site a slightly harder target, and you reduce the chance of being swept up in a mass automated attack. It’s a cheap, low-risk step that costs nothing and adds a small layer of friction for attackers.

How to Hide the PHP Version Header

There are several ways to remove or alter the X-Powered-By header, depending on your server setup and access level.

1. Edit php.ini (Recommended)

The most direct method is to change the expose_php directive in your php.ini file. Find the line:

expose_php = On

Change it to:

expose_php = Off

After saving the file, restart your web server (Apache, Nginx, or PHP-FPM) for the change to take effect. You can verify the header is gone with curl -I https://yoursite.com.

2. Using .htaccess (Apache)

If you don’t have access to php.ini, you can often add a line to your .htaccess file:

Header unset X-Powered-By

This requires the Apache mod_headers module to be enabled. It removes the header from all responses served by that directory.

3. Using Nginx

In Nginx, you can add a directive in your server block to hide the header:

fastcgi_hide_header X-Powered-By;

This works if you’re using PHP-FPM via FastCGI. If you use a proxy, you might also need proxy_hide_header X-Powered-By;.

4. Using PHP Code (Last Resort)

If you have no server-level access, you can try to remove the header in your PHP script itself, but this is unreliable because the header is sent by the server before your script runs. A common attempt is:

header_remove('X-Powered-By');

This only works if your script is the first thing that sends headers, which is rarely the case. It’s not a dependable solution.

What If You Can’t Disable expose_php?

Some shared hosting providers disable the ability to change expose_php in php.ini. In that case, you can still hide the header using a server-level configuration if you have access to .htaccess or Nginx config. If you don’t have those, you may be stuck with the header. But you can still mitigate the risk by keeping PHP up to date—the header only reveals the version, not whether it’s patched, so a current version is less interesting to attackers.

Common Mistakes and Misconceptions

• Thinking it hides all version info: The X-Powered-By header is not the only place PHP version may appear. Some frameworks or CMSs add their own version headers or meta tags. Check your full response headers and page source.
• Forgetting to clear server cache: If you use a caching plugin or a CDN, the old header may be cached. Clear caches after making the change.
• Assuming it’s a complete security fix: Hiding the header does not protect against attacks that don’t rely on version discovery. Always keep PHP updated and follow other security best practices.
• Breaking things with .htaccess: If you add Header unset to .htaccess and get a 500 error, it’s likely because mod_headers is not enabled. Remove the line and use another method.

Comparing Methods: Which Is Best?

The best method depends on your environment:

• Dedicated server/VPS: Edit php.ini—it’s the cleanest and most reliable.
• Shared hosting with .htaccess: Use Header unset if allowed.
• Nginx server: Use fastcgi_hide_header.
• Docker/container: Set expose_php = Off in your image’s php.ini.

In all cases, verify the change with curl -I or an online tool. Remember that the header might also be added by a proxy or CDN, so check the full chain.

Frequently Asked Questions

Does hiding the PHP version header slow down my site?

No. Removing a header is a trivial operation that has no measurable performance impact. It’s a one-time configuration change.

Will hiding the header break any functionality?

No, it doesn’t affect how PHP runs. The header is purely informational. Some security scanners might actually give you a better score after hiding it, but that’s not a functional change.

Is it illegal to hide the PHP version?

No, it’s completely legal. It’s your server and you can choose what headers to send. It’s a common practice.

Can I still see the PHP version if I need it for debugging?

Yes. You can run phpinfo() in a temporary script (and delete it afterward) or check the version from the command line with php -v. Hiding the header doesn’t hide the version from you, only from external clients.

What if I use a CMS like WordPress? Does it add its own version header?

WordPress itself doesn’t add a PHP version header, but it may add a X-Powered-By header if PHP is configured to do so. Some plugins or themes might add their own meta tags with version numbers—check your page source for generator tags.

After hiding the header, should I also hide the server signature (Apache/Nginx)?

Yes, it’s a good idea. The Server header reveals the web server software and version. You can hide it with ServerTokens Prod in Apache or server_tokens off; in Nginx. Doing both reduces the information available to attackers.

Related

• FRP Lock Removal Tools: How They Work
• Transfer Contacts One Account Another: Full Guide
• Replaceable vs Rechargeable Controller Batteries: Which Is Better?