note 104137 added to function.header

Hide away your environment information (if you cannot do this at server level): <?php header('Server: '); header('X-Powered-By: '); ?> Why? Attackers are ALWAYS looking for servers with old versions running to exploit unpatched vulnerabilities. Now let's see what a typical server says: Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_fcgid/2.3.5 Phusion_Passenger/2.2.15 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 I have so much information from this it's incredible. Apache 2.2.17 on a Unix-style distro (instead of Windows) mod_ssl 2.2.17 OpenSSL 0.9.8, and guess what rhel5 means? Red Hat Overall, WAY too much information. Why not just 'Server: Apache'? So what do I do if I'm an attacker? I have already scanned this information to find it like usual and now I just have to find exploits on sites like http://seclists.org/ or if I have already have something usable I can use it. Not only that, but often: X-Powered-By: PHP/5.2.17 might show up. Now all I have to do is search for vulnerabilities in that PHP EXACT version which was given to me. Execute code remotely, get the information I need, then break in and do whatever I like with the target once an exploit succeeds. (Note the above is completely theoretical.) X-Powered-By is sometimes sent by mod_php. It seems to always be over-ridable. It is not sent by PHP-FPM. The Server header is of course, sent by almost every server. What is strange is that Apache and many distros decide to display everything about their environment by default. Don't get why. There are no issues if Server or X-Powered-By is not present in any browser. Generally speaking, no other end should need to know what the server is running, ever. With nginx, the Server header can be overriden by PHP probably because PHP is handled by a separate process and is AFTER nginx has prepared its header (which is usually simply nginx/<version>). You can turn off version number displaying with 'server_tokens off' in your nginx configuration. This will result in 'Server: nginx' as your header. With Apache, it doesn't seem to be overridable with mod_php. Perhaps it's overridable with FastCGI but I have not tested. Also, I have not tested lighttpd. ---- Server IP: 69.147.83.197 Probable Submitter: 99.178.255.238 ---- Manual Page -- http://www.php.net/manual/en/function.header.php Edit -- https://master.php.net/note/edit/104137 Del: integrated -- https://master.php.net/note/delete/104137/integrated Del: useless -- https://master.php.net/note/delete/104137/useless Del: bad code -- https://master.php.net/note/delete/104137/bad+code Del: spam -- https://master.php.net/note/delete/104137/spam Del: non-english -- https://master.php.net/note/delete/104137/non-english Del: in docs -- https://master.php.net/note/delete/104137/in+docs Del: other reasons-- https://master.php.net/note/delete/104137 Reject -- https://master.php.net/note/reject/104137 Search -- https://master.php.net/manage/user-notes.php