Search Results

Follow the steps below to remediate this finding on WordPress. Avoid building file paths from user input in custom themes and plugins.Use WordPress file API functions (get_template_directory(), WP_Filesystem) rather than raw PHP filesystem functions.Sanitise a...

Follow the steps below to remediate this finding on Joomla. Use JPath::clean() to normalise paths and JPath::check() to validate that the resolved path is within the allowed base directory:JPath::check($filePath);Never pass raw user input to JFile::read() or P...

Follow the steps below to remediate this finding on Drupal. Use Drupal's file system service to resolve paths safely:$file_system = \Drupal::service('file_system'); $realpath = $file_system->realpath($uri);Never build file paths from unvalidated user input.Use...

Follow the steps below to remediate this finding on Microsoft IIS webserver. In IIS Manager, select your site and open HTTP Response Headers.If X-Powered-By is listed, select it and click Remove in the Actions pane.For ASP.NET, also remove the X-AspNet-Version...

Follow the steps below to remediate this finding on Nginx webserver. PHP-FPM adds X-Powered-By by default. Disable it in php.ini:expose_php = OffRestart PHP-FPM:sudo systemctl restart php8.x-fpmAlternatively, strip the header in Nginx:fastcgi_hide_header X-Pow...

Follow the steps below to remediate this finding on Apache webserver. Disable PHP version exposure in php.ini:expose_php = OffTo also suppress the header at the Apache level, ensure mod_headers is enabled and add:Header unset X-Powered-By Header always unset X...

Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional Apache directives", add:Header unset X-Powered-ByUnder "Additional nginx directives", add...

Follow the steps below to remediate this finding on Microsoft IIS webserver. IIS does not include a Server header with version details by default, but if it does, install the URL Rewrite module and add an outbound rule to remove or replace the header:<rewrite>...

Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf http or server block, add:server_tokens off;This removes the version number from the Server header and error pages.Reload Nginx:sudo systemctl reload nginxFor complete Serv...