Server Configuration

Server Configuration Information Check

Learn to identify HTTP headers (Server, X-Powered-By) that disclose your server configuration, and how to mask them to reduce targeted attack risks.

What this test checks

This test checks whether sensitive server configuration information is exposed via HTTP headers (Server, X-Powered-By, X-Generator). These headers reveal versions of your web server, PHP, or CMS, allowing attackers to identify known vulnerabilities and exploit them.

Our recommendation

Configure your server to hide version and technology information. Apache: remove or modify the Server header with 'ServerTokens Prod' and 'ServerSignature Off'. Nginx: use 'server_tokens off'. Disable the X-Powered-By header in PHP (expose_php = Off) or via your framework.

Security tests

View all tests

CMS Security

Server Configuration Information Check

What this test checks

Our recommendation

Read more

WordPress Theme Editor Access Check

X-Frame-Options Header Check

Magento env.php File Access Check

Server Status Pages Access Check

WordPress Admin Access Check

WordPress REST API Access Check

Shopify Backup File Exposure Check

Joomla Backup File Exposure Check

Shopify SQL Injection Protection Check

Database Backup File Exposure Check

Shopify Content-Security-Policy Header Check

Shopify HTTP Security Headers Check

Joomla Upload Folder Indexing Check (images/)

Shopify Sensitive File Exposure Check

PrestaShop Admin Access Restriction Check

Shopify Password Protection Check

Directory Indexing Check

Magento Admin Access Check

Joomla Cron Access Check

Joomla Version Check

Shopify Cart Endpoint Exposure Check

Malicious File Presence Check in Upload Folders

CNIL Mention in Privacy Policy Check

PHP Error Display on PrestaShop Check

WordPress Upload Folder Indexing Check (wp-content/uploads/)

Shopify XSS Protection Check

CAPTCHA Presence on Admin Page Check

PrestaShop Backup File Exposure Check

Email Address Exposure Check

Drupal Admin Login Page Protection Check

Drupal Admin Access Check

wp-config.php File Access Check

Shopify File Upload Security Check

CAPTCHA Presence on Password Reset Form Check

Joomla REST API Access Check

admin-ajax.php Accessibility Check

PHP Error Display on Drupal Check

Configuration File Exposure Check

PrestaShop Admin Access Check

Shopify Contact Form CAPTCHA Protection Check

PrestaShop parameters.php File Access Check

Cache Policy Check (Cache-Control, Pragma, Expires)

Magento Git File Exposure Check

Shopify Cookie Consent Banner Presence Check

PHP Error Display on Magento Check

Shopify Error Display Check

CAPTCHA Presence on Public Forms Check

Two-Factor Authentication (2FA) Check

Shopify X-Frame-Options Header Check

Shopify SSL/TLS Configuration Check

Shopify Client Login CAPTCHA Protection Check

Magento Configuration File Exposure Check

CAPTCHA Presence on Contact Form Check

Magento Admin Login Page Protection Check

Magento Log File Exposure Check

Information Leak via HTTP Headers Check

PHP Error Display in Production Check

CAPTCHA Presence on Registration Page Check

Upload Folder Protection Check (.htaccess, index.html files)

Clear-Site-Data Header Check

Shopify Upload Folder Security Check

PrestaShop Log File Exposure Check

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

CORS Configuration Check (Access-Control-Allow-Origin)

CMS Vulnerability Check

Shopify Permissions-Policy Header Check

Drupal Temporary Folder (tmp/) Access Check

Drupal Log File Exposure Check

Cross-Origin-Opener-Policy Header Check

X-Content-Type-Options: nosniff Header Check

Index File Presence in Upload Folders Check

Drupal Admin Access Restriction Check

Shopify Storefront API Exposure Check

Access to wp-cron.php Check

Magento Backup File Exposure Check

Shopify HSTS Header Check