Exposure

Many servers announce which software they run, and which version, with every page they send. Visitors don't notice it, but anyone can read it, and automated attacks read it to find servers with known security holes. Hiding it takes a setting or two.

What WP Moo looks at

Along with every page, the server sends headers: short lines of information browsers read but don't show. We look at the headers of your Home page for:

A version number in the Server, X-Powered-By, X-AspNet-Version or X-Generator header, like nginx/1.18.0 or PHP/8.1.2.
Any sign of the Plesk hosting panel, even without a version.

A bare name like "nginx" or "Apache" is fine and raises nothing.

We also show where the page gives away the WordPress version: in the generator tag or on WordPress's own files. That never becomes a problem, because WordPress shows it on every site out of the box. Open "Show what we saw" next to Exposure under Site checks on the site's Overview to see each one.

We read this from the latest successful check of your Home page (the page at /), so the check sends no extra requests to your site. That's also why it needs the Home page: when that page hasn't loaded properly for over a day, Exposure stops judging it, and once its last result is two days old it says it couldn't check. If you switch the Home page off, Exposure has nothing to read.

What the problems mean

Server software visible in the headers Notice Turn them off where the server adds them. On a Plesk server the Plesk setting is server-wide, so one change fixes every site on it.

Out of the box: Notice when a header shows a version number or Plesk. What each priority means: Problem priority.

How to fix it

These headers are set by the server, not by WordPress, so a plugin can rarely remove them.

Find the setting for each header we found under For your developer below. When this is the problem at the top of the site overview, Forward to my developer opens an email with those settings, ready to send.
On your own server or VPS, change that setting, then reload the web server or PHP.
On shared hosting, send this page to your host and ask them to hide the versions.

On a Plesk server the Plesk setting is server-wide, so one change fixes every site on it. The PHP setting is per PHP version, so change it for each version your sites use. WP Moo sees the change on its next check and the problem goes away by itself.

For your developer

The check reads the response headers of the Home page's latest successful page check, after its redirects. To see them (the last block is the one we read):

curl -sL -A 'WPMooBot/1.0 (+https://wp-moo.com/bot)' -D - -o /dev/null https://example.com/

A header counts when its value holds a dotted version (nginx/1.18.0) or a bare number after a slash or a name (Apache/2, Drupal 10), or when X-Powered-By-Plesk is present or any of these headers mentions Plesk. The usual fixes:

# nginx
server_tokens off;

# Apache
ServerTokens Prod

# php.ini
expose_php = Off

# Plesk panel.ini, then run: plesk repair web
[webserver]
xPoweredByHeader = off

For IIS 10 and later, set removeServerHeader="true" on requestFiltering and enableVersionHeader="false" on httpRuntime in web.config. For LiteSpeed, set Server Signature to Hide Version in the WebAdmin console. For X-Generator, or an X-Powered-By that doesn't come from PHP, turn the header off in the software that adds it.

Something unclear on this page? Email [email protected]

Exposure

What WP Moo looks at

What the problems mean

How to fix it

For your developer

Cookies