Server or PHP version disclosed in response headers

What it is

The server's response headers reveal the exact web server and/or PHP version in use. That's free reconnaissance for an attacker looking for a known, unpatched vulnerability that matches your exact versions.

How to fix it

Turn off version disclosure in your server/PHP configuration (e.g. ServerTokens/ServerSignature in Apache, server_tokens in nginx, expose_php=Off in php.ini). If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your website is publicly showing the exact version numbers of WordPress and your server software to anyone who visits, which is like advertising the specific lock model on your front door. Hackers use automated tools to scan websites for these version numbers because older versions have known security weaknesses they can exploit. To fix this, you have two practical options: you can use a WordPress security plugin like Wordfence or iThemes Security, which have a simple setting to hide version information automatically, or you can contact your web host and ask them to disable version disclosure in your server headers. Either approach takes just a few minutes and will immediately stop broadcasting this information to potential attackers.