Skip to content

4509-nginx-xpoweredby-Ensure NGINX Reverse Proxy Does Not Expose Technology Information¶

Rule ID¶

4509-nginx-xpoweredby

Category¶

nginx

Level¶

info

Compatible Versions¶

Linux

Description¶

The Server and X-Powered-By headers can reveal the underlying technology used by an application. If not explicitly configured, NGINX reverse proxy can strip these headers by using proxy_hide_header.

Scan Frequency¶

0 */30 * * *

Rationale¶

Attackers can use these response headers to perform reconnaissance on a website, then target specific known vulnerabilities associated with the underlying technology. Removing these headers reduces the likelihood of targeted attacks.

Risk Item¶

NGINX Security

Audit Method¶

Execute the following command to verify:

grep proxy_hide_header /etc/nginx/nginx.conf
# Expected output:
proxy_hide_header X-Powered-By;
# If not present, it is recommended to add it.

Remediation¶

Edit the file /etc/nginx/nginx.conf and add the header directives. Example:

location /docs {
....
proxy_hide_header X-Powered-By;
proxy_hide_header Server;
....
}

Impact¶

None

Default Value¶

By default, this configuration is not present.

References¶

None

CIS Controls¶

None