How to Hide PHP Version in HTTP Headers (expose_php Guide)

Is your server showing its PHP version to everyone? Many sites still send a header like X-Powered-By: PHP/8.2.x with every page. In 2012 I found that even after I turned off the server signature to hide Apache details, the PHP version still appeared in our site headers. Here is how to hide the PHP version in HTTP headers in 2026, on shared hosting, Apache, Nginx and LiteSpeed.

Quick answer: To hide the PHP version, set expose_php = Off in php.ini (or in your host’s PHP settings), then restart PHP. If the X-Powered-By header still appears, remove it at the web server: Header unset X-Powered-By in Apache or LiteSpeed, or fastcgi_hide_header X-Powered-By; in Nginx. Then check your headers again.

Why hide the PHP version?

The PHP version header tells anyone, including bots scanning for weak sites, exactly which version you run. If that version has known security holes, attackers know what to try. Hiding it does not fix vulnerabilities, but it removes an easy clue. The real fix is to keep PHP updated; see how to find your server’s PHP version.

How to check your site headers

• Run curl -I https://yoursite.com in a terminal and look for X-Powered-By.
• Or open your browser’s DevTools (F12), go to the Network tab, reload the page, click the first request and view Response Headers.

Method 1: Turn off expose_php in php.ini

PHP adds the header because of the expose_php (external site) setting, which is on by default.

1. On shared hosting: open your control panel’s PHP settings (for example hPanel > Advanced > PHP Configuration, or cPanel > MultiPHP INI Editor) and switch expose_php off.
2. On a VPS: find the php.ini in use with php --ini (and the PHP-FPM version for your web server), back it up, and set:

   expose_php = Off

3. Restart PHP-FPM or your web server, for example sudo systemctl restart php8.3-fpm.

expose_php cannot be changed in .htaccess or with ini_set(), because PHP reads it at startup.

Method 2: Remove the header in the web server

Apache or LiteSpeed (.htaccess)

<IfModule mod_headers.c>
  Header unset X-Powered-By
  Header always unset X-Powered-By
</IfModule>

Nginx

fastcgi_hide_header X-Powered-By;

Add it inside the server or PHP location block, then run sudo nginx -t and reload Nginx.

Behind Cloudflare or a CDN

You can also remove response headers with a CDN rule, such as Cloudflare’s Transform Rules, so the header never reaches visitors.

Other headers worth hiding

• Server: set ServerTokens Prod and ServerSignature Off in Apache, or server_tokens off; in Nginx.
• WordPress version: the generator meta tag shows your WordPress version; security plugins can remove it, but keeping WordPress updated matters more. See how to find WordPress, PHP and MySQL versions.

How I did it in 2012

I logged in with FileZilla (external site), found the global php.ini (then at /usr/local/lib/php.ini on our server), saved a backup, added expose_php = off, uploaded it back and restarted. The X-Powered-By header disappeared from our site headers.

FAQ

Does hiding the PHP version make my site secure?

No. It only hides one clue. Keeping PHP, WordPress and plugins updated is what protects you.

Why does X-Powered-By still show after setting expose_php off?

You may have edited the wrong php.ini, not restarted PHP-FPM, or a plugin or app adds the header. Remove it at the web server level too.

Is it safe to edit php.ini?

Yes, if you keep a backup. A typo can stop PHP from starting, so test your site right after.

Can I hide PHP version on shared hosting?

Usually yes, through the host’s PHP settings or a .htaccess Header unset rule.