What this checker tests
Before attacking a website, an intruder usually starts by reading its response headers. This step is called banner grabbing, and it is the fingerprinting stage of an attack. The Server header might announce the web server and version, the X-Powered-By header often names the language or framework, and a few related headers reveal the application stack. Each detail narrows down what software is running so the attacker knows where to aim.
This checker fetches the live response from the URL you enter and reports the Server value, the X-Powered-By value, and any other headers that disclose software details. If none of them expose a precise banner, you get a clean result. If they do, you see exactly what is leaking so you can shut it off.
Why version disclosure helps attackers
A version number is a map to known vulnerabilities. When a header reads nginx/1.18.0 or PHP/7.4.3, an attacker can search public CVE databases for that exact build and immediately know which published exploits might work, with no guesswork and no noisy probing that might trip an alarm. Removing the version, and ideally the whole header, takes that shortcut away and forces an attacker to spend effort they would rather not spend. For the full background, see the information disclosure guide.
How to remove or mask these headers
On Nginx, set server_tokens off in the http or server block to drop the version from the Server header, and if you sit behind a proxy, strip the upstream header with proxy_hide_header X-Powered-By so nothing leaks through. On Apache, set ServerTokens Prod and ServerSignature Off in the main configuration to trim the Server banner down to a bare product name. In an Express app, call app.disable('x-powered-by') once at startup, or use a package such as helmet that removes it for you along with other hardening. After you change any of these, run this checker again to confirm the headers are gone.