Removing X-Powered-By: Crawl Audit check 154

Short answer: some frameworks add an X-Powered-By header naming the software behind your site, sometimes with a version. Visitors never need it. Check 154 warns whenever it's present.

What Crawl Audit checks

• Pass: no X-Powered-By header.
• Warning: the header is present. The report shows its value.

What the sources say

• OWASP: "This information exposes the server to attackers." And: "Remove all X-Powered-By headers."
• Express: "By default, Express sends the X-Powered-By response header".
• Next.js: "By default Next.js will add the x-powered-by header."
• Express is honest about the limits: "Disabling the X-Powered-By header does not prevent a sophisticated attacker from determining that an app is running Express."

Turning it off

• Express: app.disable('x-powered-by');
• Next.js: poweredByHeader: false in next.config.js
• PHP: expose_php = Off in php.ini

It's a two-minute change that removes a free clue. As with check 153, keeping the framework updated matters far more.

On devmarde.com

Our responses had no X-Powered-By header on 6 October, so it passes.

Sources

• OWASP, HTTP Headers Cheat Sheet.
• Express, Security best practices, and Next.js, poweredByHeader, checked 6 October 2026.