How to hide your server, PHP and WordPress version
Short answer: set server_tokens off; in nginx, ServerTokens Prod and ServerSignature Off in Apache, expose_php = Off in php.ini, and remove WordPress’s generator tag. This stops automated tools from matching your exact versions to known exploits. It is a small extra, not a fix: outdated software still needs updating.
See what you reveal
curl -sI https://yourdomain.com | grep -iE '^(server|x-powered-by):'
curl -s https://yourdomain.com | grep -io '<meta name="generator"[^>]*>'nginx
server_tokens off; # in the http { } blockApache
These go in the main server configuration (not .htaccess). Restart Apache afterwards.
ServerTokens Prod
ServerSignature OffPHP
expose_php = OffOn shared hosting, look for a PHP settings page in your control panel. Restart PHP-FPM if you manage the server.
WordPress
<?php
// wp-content/mu-plugins/no-generator.php
remove_action( 'wp_head', 'wp_generator' );
add_filter( 'the_generator', '__return_empty_string' );Also delete readme.html from the site root (it comes back with updates, so check after each one).
Why updating matters more
Attackers often try exploits without checking versions first. Hiding the number removes an easy signal, but the only real fix for an old version is to update it. HackGrade rates visible version numbers as low risk, and a PHP version that is out of support as higher risk.
Frequently asked questions
Will hiding versions improve my security grade?
Slightly. Version disclosure is a low-severity finding. Updating outdated software has a much bigger effect.
Can I remove the Server header completely?
Not with stock nginx or Apache, but you can reduce it to the product name. Some CDNs replace it with their own name.
Does hiding the WordPress version stop plugin version detection?
No. Plugin and theme files often carry their own version strings. Keep them updated.