Disable X-Powered-By Header by Default

[Maarten-Dekker]

I would like to propose disabling the X-Powered-By header by default. This header, which reveals the PHP version is currently included in HTTP responses. Sending these types of HTTP headers:

• does not provide any value to the user experience
• contributes to header bloat
• exposes information to potential attackers about the technology stack being used

See https://webhint.io/docs/user-guide/hints/hint-no-disallowed-headers/?source=devtools.

Proposed Solution

Set expose_php = On to expose_php = Off by default in php.ini.

[jaydrogers]

Thanks for pointing this out! I will put this in the next release 👍