Every response your web server sends includes HTTP headers - small pieces of metadata. When the server includes its name and version number (such as "nginx/1.27.2") in these headers, that information is visible to anyone who requests a page.
Why this matters
Attackers routinely scan for specific server versions that have known vulnerabilities. Advertising your version makes it trivial to identify your site as a potential target for automated attacks.
How to fix it
Configure your web server to remove or suppress the Server header, or replace it with a generic value. This is typically a one-line change in the server configuration file.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.