Audit rules
X-Powered-By Version Disclosed
The X-Powered-By header reveals a software version number (for example "PHP/8.2.12"). Listed under Security in the plan. In a QuikSEO audit, a failure of this rule has info severity and counts against the score. Below are the exact condition, its exceptions and the sources behind it, followed by the other rules of the same group.
http.powered_byInfo01 — Definition
How This Rule Is Checked
The rule is a pure function of the fetched page: no extra requests, no account settings. The same input always gives the same result.
Rule Severity and Score
- Rule id
http.powered_by- Group
- HTTP
- Severity of a failure
- Info
- Counts in the score
- Yes, whenever it applies to the page
- Required for a score
- No
Condition and Exceptions
- Condition
- X-Powered-By value with a version number (same pattern as http.server_header) → fail (info)
- Exceptions
- No header or no version → pass; HTML mode → not_checked
Sources and Project Decision
- Sources
- HTTP Headers Cheat Sheet (OWASP Cheat Sheet Series), X-Powered-By (OWASP, Q16)
OWASP HTTP Headers Cheat Sheet: remove X-Powered-By, non-informative Server (OWASP, Q12) - Project decision
- Info (lot 2), mirroring http.server_header: a fail only when the value carries a version number.
02 — HTTP
Other Rules in This Group
The other checks of the same group, each with its own condition and sources.
- No Cache Validatorshttp.cache_validators
- HTML Not Compressedhttp.compression
- Page Answers With an Error Statushttp.error_status
- WWW and Non-WWW Both Serve the Pagehttp.host_variant_duplicate
- HTTP Protocol Versionhttp.http2
- HTTP Version Not Redirected to HTTPShttp.http_variant_not_redirected
- Page Not Served Over HTTPShttp.https
- Mixed Contenthttp.mixed_content
- Redirect Chainhttp.redirect_chain
- Server Version Disclosedhttp.server_header
- TLS Certificate Expiring Soonhttp.tls_expiring
- Invalid TLS Certificatehttp.tls_invalid