CMS/server version hidden
Some sites display in their code which version of WordPress, PHP or other software they use. It's like publicly announcing which lock you ha…
Analyse my site for freeUnderstanding "CMS/server version hidden"
By default, many web servers and CMSs publicly announce their exact version: the X-Powered-By HTTP header can reveal PHP/7.2.1, while the <meta name="generator"> tag automatically inserted by WordPress, Joomla or Drupal often indicates the precise CMS version. In security terminology this information is called a banner, and retrieving it is called banner grabbing.
The issue isn't using a particular technology — that's normal and not something you can hide in absolute terms — but revealing its exact version. A precise version lets an attacker instantly check public vulnerability databases (CVEs) and immediately know whether your installation is vulnerable to a known flaw, without guessing or blind testing.
<meta name="generator" content="WordPress 5.4">
↳ direct lookup of PHP 7.2.1 / WP 5.4 CVEs
(generator tag absent or without a version number)
How TheSiteFuse checks "CMS/server version hidden"
TheSiteFuse inspects the X-Powered-By HTTP response header as well as the <meta name="generator"> tag on the homepage. If either contains a pattern resembling a version number (a regular expression like \d+\.\d+, e.g. "5.4" or "7.2"), the check flags a version exposure warning, citing the exact value found.
Why "CMS/server version hidden" matters
- Targeted exploitation of known CVEs — a precise version lets an attacker check databases like the NVD (National Vulnerability Database) and immediately know what public exploits exist, with no extra reconnaissance effort.
- Automatic target prioritisation — mass scanners (Shodan, Censys) index exposed versions across the entire internet; a site with a known old version becomes an automatically sorted target, often before any human even gets involved.
- Exploitation window between CVE disclosure and patching — as soon as a vulnerability is published for a given version, automated scans targeting that exact version begin within hours. An exposed version shrinks the time you have to patch before being discovered.
Fix "CMS/server version hidden" step by step
PHP — hide the version
# php.ini expose_php = Off
WordPress — remove the generator tag
// functions.php
remove_action('wp_head', 'wp_generator');
Apache — hide the server version
# httpd.conf ServerTokens Prod ServerSignature Off
Nginx — hide the server version
# nginx.conf server_tokens off;
Important reminder: hiding the version is a defence-in-depth measure, not a protection on its own — it complicates automated reconnaissance but never replaces regularly applying security updates. An up-to-date site remains the best protection, whether it exposes its version or not.
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — CMS/server version hiddenDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.