Advanced Search
Search Results
176 total results found
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. PHP-FPM adds X-Powered-By by default. Disable it in php.ini:expose_php = OffRestart PHP-FPM:sudo systemctl restart php8.x-fpmAlternatively, strip the header in Nginx:fastcgi_hide_header X-Pow...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. Disable PHP version exposure in php.ini:expose_php = OffTo also suppress the header at the Apache level, ensure mod_headers is enabled and add:Header unset X-Powered-By Header always unset X...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional Apache directives", add:Header unset X-Powered-ByUnder "Additional nginx directives", add...
Remediation Steps
Follow the steps below to remediate this finding on Microsoft IIS webserver. IIS does not include a Server header with version details by default, but if it does, install the URL Rewrite module and add an outbound rule to remove or replace the header:<rewrite>...
Remediation Steps
Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf http or server block, add:server_tokens off;This removes the version number from the Server header and error pages.Reload Nginx:sudo systemctl reload nginxFor complete Serv...
Remediation Steps
Follow the steps below to remediate this finding on Apache webserver. In apache2.conf or httpd.conf, set:ServerTokens Prod ServerSignature Off ServerTokens Prod reduces the Server header to just "Apache" without version details.Reload Apache:sudo systemctl rel...
Remediation Steps
Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional nginx directives", add:server_tokens off;Under "Additional Apache directives", add:Server...
Remediation Steps
Follow the steps below to remediate this finding on Windows. Enable SMB signing via Group Policy to require it on all connections.Open Group Policy Management (gpmc.msc).Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies...
Remediation Steps
Follow the steps below to remediate this finding on Linux (Debian/Ubuntu). For Samba servers, edit /etc/samba/smb.conf and add to the [global] section:server signing = mandatory client signing = mandatoryRestart Samba:sudo systemctl restart smbd nmbd
Remediation Steps
Follow the steps below to remediate this finding on Linux (RHEL/CentOS/AlmaLinux). For Samba servers, edit /etc/samba/smb.conf and add to the [global] section:server signing = mandatory client signing = mandatoryRestart Samba:sudo systemctl restart smb nmb
Remediation Steps
Follow the steps below to remediate this finding on Generic / Developer guidance. SQL injection occurs when untrusted input is concatenated into SQL queries without proper parameterisation.Remediation:Always use parameterised queries / prepared statements:PDO ...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Always use $wpdb->prepare() for custom queries:$results = $wpdb->get_results( $wpdb->prepare('SELECT * FROM wp_posts WHERE ID = %d', $postId) );Use the WordPress query API (WP_Query, get_posts()) i...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Use the Joomla Database API to build parameterised queries:$db = JFactory::getDbo(); $query = $db->getQuery(true) ->select('*') ->from($db->quoteName('users')) ->where($db->quoteName('id') . ' = ' . $...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Use Drupal's database abstraction layer for all queries:$results = \Drupal::database()->select('users', 'u') ->fields('u') ->condition('uid', $uid, '=') ->execute() ->fetchAll();For complex queries, u...
Remediation Steps
Follow the steps below to remediate this finding on Generic / Developer guidance. MySQL-specific SQL injection exploits MySQL syntax and functions.Remediation:Use PDO or MySQLi with prepared statements — never string-concatenate user input into queries.Disable...
Remediation Steps
Follow the steps below to remediate this finding on WordPress. Use $wpdb->prepare() for all custom MySQL queries:$results = $wpdb->get_results( $wpdb->prepare('SELECT * FROM wp_users WHERE user_login = %s', $username) );Ensure the WordPress database user only ...
Remediation Steps
Follow the steps below to remediate this finding on Joomla. Use the Joomla Database API with $db->quote() for all MySQL queries.Ensure the Joomla database user has only the necessary MySQL privileges.Enable Joomla's SQL debug log in development to detect unpar...
Remediation Steps
Follow the steps below to remediate this finding on Drupal. Use Drupal's database abstraction layer, which automatically escapes and parameterises MySQL queries.Review any custom modules using db_query() with raw string interpolation and replace with the query...