Header Security

Information Leak via HTTP Headers Check

Discover which HTTP headers (X-Powered-By, X-AspNet-Version, etc.) can expose technical information and how to disable them to enhance site security.

What this test checks

This test detects the presence of sensitive HTTP headers that disclose technology information (framework, server version, language). This information can be used by attackers to target specific vulnerabilities of those technologies.

Our recommendation

Remove or disable the following headers: X-Powered-By (PHP, ASP.NET), X-AspNet-Version, X-Generator (CMS), X-Drupal-Dynamic-Cache, X-Varnish. In Apache, use 'Header unset'; in Nginx, 'proxy_hide_header' or 'more_clear_headers'. Also check that your framework does not generate these headers automatically.

Security tests

View all tests

Data Exposure

Information Leak via HTTP Headers Check

What this test checks

Our recommendation

Read more

Magento Git File Exposure Check

Magento Session Cookie Security Check

CMS Vulnerability Check

Shopify REST API Exposure Check

Cache Policy Check (Cache-Control, Pragma, Expires)

Installation Log File Exposure Check

Drupal Upload Folder Indexing Check (sites/default/files/)

Shopify Referrer-Policy Header Check

HSTS Header Check (HTTP Strict Transport Security)

Drupal Temporary Folder (tmp/) Access Check

Joomla Upload Folder Indexing Check (images/)

Shopify CSRF Protection Check

Shopify X-Content-Type-Options Header Check

HttpOnly Flag on Joomla Session Cookies Check

Shopify Permissions-Policy Header Check

Drupal Admin Access Check

Magento Configuration File Exposure Check

Drupal Admin Login Page Protection Check

Magento Admin Access Check

PHP Error Display on Drupal Check

CAPTCHA Presence on Client Login Page Check

Shopify Contact Form CAPTCHA Protection Check

Shopify Error Display Check

PrestaShop Admin Login Page Protection Check

CAPTCHA Presence on Registration Page Check

Privacy Policy Page Presence Check

Server Status Pages Access Check

PHP Error Display on Joomla Check

Plaintext Password Exposure Check

xmlrpc.php Access Check

Joomla REST API Access Check

Email Address Exposure Check

Drupal Log File Exposure Check

PrestaShop Admin Access Restriction Check

CNIL Mention in Privacy Policy Check

CAPTCHA Presence on Contact Form Check

API Key Exposure Check

.htaccess File Presence and Security Check

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

Shopify Cart Endpoint Exposure Check

Joomla Cron Access Check

Authentication File Exposure Check (.htpasswd, .user.ini)

Joomla Admin Login Page Protection Check

WordPress REST API Access Check

SSL Certificate Check

Drupal Version Check

CORS Configuration Check (Access-Control-Allow-Origin)

Joomla Administrator Interface Access Check

Shopify Terms and Conditions (T&C) Presence Check

Magento Cache Folder Access Check

Shopify Admin CAPTCHA Protection Check

Magento Backup File Exposure Check

Shopify Cookie Consent Banner Presence Check

PrestaShop Log File Exposure Check

Shopify Version Check

SQL Query Exposure Check

Drupal settings.php File Access Check

Access to wp-cron.php Check

Magento Admin Login Page Protection Check

Cross-Origin-Opener-Policy Header Check

Shopify Sensitive File Exposure Check

Two-Factor Authentication (2FA) Check

Shopify Admin Access Restriction Check

Shopify Content-Security-Policy Header Check

Directory Indexing Check

Referrer-Policy Header Check

WordPress Version Check

Magento Version Check

PrestaShop Admin Access Check

Joomla Version Check

PrestaShop Session Cookie Security Check

PrestaShop Upload Folder Indexing Check

Shopify API Key Exposure Check

Cookie Security Check

CAPTCHA Presence on Password Reset Form Check

WordPress Upload Folder Indexing Check (wp-content/uploads/)