ASVS 5.0 V13.4.6 is a Level 3 requirement. The application must not expose detailed version information about its backend components, such as the exact web server, framework or database version.
Why it matters
A banner like Server: Apache/2.4.49 lets an attacker skip fingerprinting and go straight to the exploit list for that release. Hiding versions does not fix vulnerabilities, so patching comes first. But it does slow targeted attacks and reduces noise in your logs from automated scanners.
How to implement it
server_tokens off;
more_clear_headers Server X-Powered-By;
ServerTokens Prod
ServerSignature Off
Express:
app.disable("x-powered-by");
Spring Boot and similar: do not return framework names in error bodies, and set server.error.whitelabel.enabled=false.
Check less obvious places: error pages, Via headers from proxies, database error messages that quote the server version, and API fields such as "backend_version".
How to test it
curl -sI https://example.com/ | grep -iE "^(server|x-powered-by|x-aspnet|via):"
You want no version numbers. Then trigger a 404 and a 500 and read the bodies.
Common mistakes
- Removing the header at the application but not at the load balancer.
- Hiding versions and then skipping patches because "nobody can tell".
- Leaving version strings in static asset comments, such as banners in minified bundles.
Quick check
Is a bare product name, such as nginx with no number, acceptable?
The requirement targets detailed version information, so a product name alone passes. Removing it entirely is still better.
