HTTP Response Security — Server Headers & Information Disclosure

What is "server fingerprinting"?

When your browser connects to a website, the server often replies with a header telling exactly what software it's running — for example, Server: nginx/1.18.0 or X-Powered-By: PHP/7.4.3. On its own this looks harmless, but it's effectively a signpost that says "attack me with exploits designed for this exact version." Automated bots scan the web constantly, reading this one header to decide which sites are running old, vulnerable software worth targeting.

Why hiding your attack surface matters

• Version disclosure — tells attackers precisely which known vulnerabilities (CVEs) might apply to your server, skipping the guesswork.
• Misconfigured CORS — Cross-Origin Resource Sharing controls which other websites are allowed to make requests to your server and read the response. If it's set too loosely (e.g. allowing any origin to make authenticated requests), another website can silently pull private data from a logged-in user's session.
• Wildcard CORS + credentials — a specific, more severe misconfiguration where a wildcard origin is combined with credentials allowed. Browsers are supposed to reject this combination outright, but some servers still send it — usually a copy-pasted config mistake.
• Overly broad CORS methods — allowing PUT/DELETE/PATCH cross-origin (or a wildcard) is a common sign CORS was configured from a permissive example rather than deliberately scoped.
• Cross-origin isolation — two newer headers (COOP/COEP) that isolate your page from other browser tabs/windows trying to interact with it, closing a class of side-channel attacks.

How to fix it

Hiding version headers is usually one config line on your server (your hosting provider's documentation will have the exact syntax). CORS should be restricted to only the specific domains that genuinely need cross-origin access — never a blanket wildcard on anything handling authenticated data, and never combined with credentials.

Looking for security.txt? That check now lives in the Robots, Sitemap & Security.txt guide, alongside deeper checks like its Canonical field and Expiry validity.