Disable PHP and Server Signature Headers¶

Note

In some server (i.e. namecheap shared hosting) by default the signatures are disabled. So you have nothing to do more.

Step by step instructions how to disable PHP and Server Signature Headers.

Disable PHP Signature: [X-Powered-By: PHP/8.x.x]¶

php.ini

expose_php = Off

.htaccess

If you cannot disable the expose_php directive to mute PHP’s talkativeness (requires access to the php.ini), you could use Apache’s Header directive to remove the header field:

Header always unset X-Powered-By
Header unset X-Powered-By

From php script

if (function_exists('header_remove')) {
    header_remove('X-Powered-By'); // PHP 5.3+
} else {
    @ini_set('expose_php', 'off');
}

If you use FastCGI try:

fastcgi_hide_header X-Powered-By;

Disable Server Signature: [Server: Apache PHP/8.x.x]¶

.htaccess

ServerSignature Off

In localhost with xampp

httpd.conf

ServerSignature Off ServerTokens Prod

References