Does your server announce its software version to everyone?
The version banner check reads the Server and X-Powered-By headers for an exact software version. A visible version helps attackers pick what to try, but it never proves the software is vulnerable.
What does this check look at?
It looks at whether response headers name server software with an exact version. MDN says the Server header describes the software used by the origin server that handled the request. OWASP adds that the X-Powered-By header exposes the server to attackers.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | No exact version was announced in those headers. | Nothing. |
| Attention | A header names software with a version number. | Remove or shorten the header, and update the software if it is old. |
A version in a banner does not prove the software is vulnerable, and no advisory is inferred from it. A detected version does not prove a vulnerability, and your host or CDN may add the header itself. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone on the internet, with no account, cookie or credential |
| The protection that should stop it | Response headers name software or versions |
| What is reached | Version and technology details |
| What follows | Helps target known issues; no access on its own |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-200 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Remove the banners where your framework or server adds them, then check your real dependency versions separately.
Stop my site from announcing software versions in response headers. Remove the X-Powered-By header (for example poweredByHeader: false in next.config, or app.disable('x-powered-by') in Express) and shorten or remove the Server header where my host lets me. Then list my server-side dependencies with their installed versions and tell me which ones have a newer patched release.How to check
Say Atlas, our example app at atlas.example, answers with an X-Powered-By header naming its framework and version. The check flags the banner and says plainly that no advisory was inferred from it.
The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.
Questions people ask
Does a version in my headers mean I am vulnerable?
No. It only tells people what you run. Whether that version has a known flaw, and whether your site uses the affected part, are separate questions.
My CDN adds the Server header. Can I remove it?
Often not, and a header naming only the CDN without a version is harmless. Focus on headers that name your own software with a version.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- HTTP Security Response Headers Cheat Sheet OWASP Cheat Sheet Series, read on October 7, 2026
- Server header MDN Web Docs, read on October 7, 2026