Don’t announce the PHP version

Removes the X-Powered-By header that tells every visitor (and every scanner) which PHP version the server runs.

Type PHP
Runs Everywhere (runs as WordPress loads)
Category Security
Tested with WordPress 7.1

PHP

<?php

add_action(
	'send_headers',
	static function () {
		if ( function_exists( 'header_remove' ) ) {
			header_remove( 'X-Powered-By' );
		}
	}
);

Good to know

Covers pages WordPress builds. Setting expose_php = Off in php.ini covers everything.

In these packs

Install it in one click

It's already in the Snipfire plugin's library. Enter your site's address and it opens there, ready to install. It arrives switched off, and Snipfire checks the code and test-loads your site before you switch it on.

Needs Snipfire on that site and you logged in as an administrator. Your address stays in this browser; we don't see it. Get Snipfire free

Or add it by hand

Click + New and choose PHP.
Paste the code and give it a name.
Where: Everywhere (runs as WordPress loads).
Save and switch it on.

Works in any snippet plugin, or a child theme's functions.php. Without the safety net, though.

Good to know

In these packs

More Security snippets

Move your snippets over this afternoon.