Hiding PHP's X-Powered-By header

Question

I know in PHP, it sends the X-Powered-By header to have the PHP version.

I also know by appending some checksums, you can get access to PHP's credits, and some random images (more info here).

I also know in php.ini you can turn expose_php = off.

But here is something I have done on a few sites, and that is use

header('X-Powered-By: Alex');

When I view the headers, I can see that it is now 'Alex' instead of the PHP version. My question is, will this send the previous PHP header first (before it reaches my header(), and is it detectable by any sniffer program? Or are headers 'collected' by PHP, before being sent back to the browser?

By the way, this is not for security by obscurity, just curious how headers work in PHP.

Solution 1

In PHP, headers aren't sent until PHP encounters its first output statement.

This includes anything before the first <?php.

This is also why setcookie sends throws a warning if you try to use it after something has been output:

Warning: Cannot modify header information - headers already sent by (output started at /path/to/php/file.php:100) in /path/to/php/file.php on line 150

Note that none of this applies if output buffering is in use, as the output will not be sent until the appropriate output buffering command is run.

Solution 2

You can set expose_php = Off in your php.ini if you don't want it to send X-Powered-By header.

PHP first compiles everything (including which headers have which values ) and then start the output, not vice-versa.

PHP is also detectable with its own easter eggs, you can read about this topic here : PHP Easter Eggs

Solution 3

See Apache Tips & Tricks: Hide PHP version (X-Powered-By)

Ups… As we can see PHP adds its own banner:

X-Powered-By: PHP/5.1.2-1+b1…

Let’s see how we can disable it. In order to prevent PHP from exposing the fact that it is installed on the server, by adding its signature to the web server header we need to locate in php.ini the variable expose_php and turn it off.

By default expose_php is set to On.

In your php.ini (based on your Linux distribution this can be found in various places, like /etc/php.ini, /etc/php5/apache2/php.ini, etc.) locate the line containing expose_php On and set it to Off:

expose_php = Off

After making this change PHP will no longer add it’s signature to the web server header. Doing this, will not make your server more secure… it will just prevent remote hosts to easily see that you have PHP installed on the system and what version you are running.

Solution 4

To get rid of the X-Powered-By header without having access to php.ini, simply add an empty header.

<?php header('X-Powered-By:'); ?>

This overwrites the default X-Powered-By header with an empty value an though most clients and applications act like this header was not sent at all.

As noticed before, this must be inserted into the code before any output is sent.

And to answer your question:

Only your X-Powered-By header will be sent because it gets replaced by your header with the same name. So it can't be detected by a 'sniffer'.

Solution 5

Headers are "collected" by PHP before being sent back to the browser, so that you can override things like the status header. The way to test it is go to a command prompt, and type:

telnet www.yoursite.com 80
GET /index.php HTTP/1.1
[ENTER]
[ENTER]

And you'll see the headers that are sent in the response (replace /index.php with the URL of your PHP page after the domain.)

View more solutions

Comments

[Pacerier]

Why had no one suggested header_remove?

[David Robertson]

An easier way to see HTTP response headers is to use curl -I http://hostname/path.

[kyle k]

why use a GET request instead of a HEAD request?

[Ludwig]

But this only advices to set 'expose_php = Off' in php.ini what alex already mentioned in his post.

[Pacerier]

@kylek, In case of Heisenbugs. Ideally you want to test both.

[Pacerier]

It doesn't remove the header but merely resets its value.

[cachius]

PHP Doc: php.net/manual/en/ini.core.php#ini.expose-php