X-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it./8.1. It is invisible to visitors but easy to read for anyone who looks, and for a PHP site it often shows the exact PHP version.
What is the X-Powered-By header?
X-Powered-By is an HTTP header that is sent along with the page. Browsers’ developer tools, scanners and curious people can all read it.
Every web response carries HTTP headersAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor.: small pieces of information sent before the page itself. Most are technical and harmless, such as the type of content or how long to cacheA cache is a store of ready-made copies, such as finished pages, so a website or browser can show something instantly instead of building it again. it. X-Powered-By is an informational one. It names the technology behind the response, for example “PHP/8.1.x”.
In PHP the header is controlled by the setting expose_php, which is on by default. When it is on, PHP adds its name and version to responses. Other platforms use the same header for their own name.
Why a version number matters
A version number tells an outsider which known flaws might apply to you. Someone checking sites in bulk can match “PHP/8.1” against the support status of that branch. We do the same in the free PHP exposure check, which reads what a site shows publicly. An attacker needs no special access to read this header, and it is the first thing a simple scan collects.
What it means for a PHP or WordPress site
The header does not create a flaw. It reveals the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., and the version is what tells you whether the branch is still supported. Sites that show an old version make it easy for anyone to see that fixes may be missing. Hiding it takes away the easy label, but not the underlying problem.
Hiding it is a small reduction of the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server., not a fix. Think of it as taking your name off the doorbell: it helps a little, and the lock still has to be good.
How to see it and remove it
You can see the header yourself in the network tab of your browser’s developer tools, under the response headers for the main page. If the line “X-Powered-By” shows PHP and a number, the header is on.
To switch it off, set expose_php to Off in php.iniphp.ini is the settings file for PHP on your hosting. It sets limits, such as how much memory a script may use, how big an upload may be and if errors show. and reload PHP, or ask your host to do this for you. Some hosts and CDNs let you strip the header at the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. or edge. After the change, load the page again and check that the line is gone.
When to act
Check the version that the header shows. If it is a branch that no longer receives fixes, or a version before the fixed releases of 21 October 2026 (8.2.35, 8.3.36, 8.4.27 or 8.5.12), the header is the least of your worries. The thing to do is update, and we can update PHP in WordPress and plan that with a stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. test and a rollbackA rollback means going back to the last version of your website that worked, after an update has gone wrong. plan. Afterwards, hiding the header is a reasonable extra. If your site only shows content, see whether a WordPress to static site move fits.
Frequently asked questions
Why does my site show X-Powered-By: PHP?
PHP can add this header to its responses and does so by default through the expose_php setting. It is not harmful on its own, but it tells anyone who asks which PHP version you run.
How do I remove the X-Powered-By header?
Set expose_php to Off in php.ini, or ask your host to do it. Some web servers and CDNs can also remove the header from responses. Restart or reload PHP afterwards and check again.
Does hiding the header make my site safe?
No. It only makes it harder for a casual scanner to read your version. A flaw in your PHP version is still there. Update PHP, and treat hiding the header as a small extra.
Is the header the only way to tell the PHP version?
No. Other signs can give it away too, such as file behavior, error messages or default pages. That is why the header is not the thing to fix first.