1

I am trying to address the above issue which is cropping up in SEO.

The following solution is the one that is suggested:

<IfModule mod_headers.c>
    # Unset Server Signature header
    ServerSignature Off
    # Unset Server Technology header
    Header unset X-Powered-By
</IfModule>
<IfModule mod_headers.c>
    # Set XSS Protection header
    Header set X-XSS-Protection "1; mode=block"
</IfModule>

I have put this in the "Additional Apache Directives", but to no avail. My server hosting company don't seem to be able to help. I am not getting any syntax errors with this. It just doesn't seem to work.

I am running Plesk 12.5.30 Update #71 on CentOS Linux 7.4.1708 (Core)‬. Apache and nginx.

Any help would be appreciated, as I am tearing my hair out with this now!

Improve this question
2
  • Why do you think this is affecting your ranking? You a!so failed to tell us what the value of the header is - there are multiple places it can be set, this would have given us a clue. And questions about service provider interfaces are off-topic; see serverfault.com/help/on-topic
    – symcbean
    Nov 21, 2017 at 23:37
  • I apologise for my obvious ignorance. I am trying to resolve what I understand to be a problem. A couple of SEO sites are highlighting this as an issue, but neither of them are telling me what they think the value of the header is. They provided the above solution, but it doesn't work. Whether or not this affects the ranking is perhaps less significant than the risks of providing helpful information to potential hackers. Sorry if this is the wrong forum. I just want to fix an issue with my server configuration. Having found similar post on this site, thought this was the place to ask!
    – Tim Clarke
    Nov 22, 2017 at 12:58

1 Answer 1

Reset to default
2

Try setting 

expose_php = Off

to your php.ini if you have access. This isn't a core apache header, but one added by mod_php. (You can confirm this by blocking mod_php from loading temporarily).

Improve this answer
3
  • I don't think I have a php.ini file at the moment. Should I create one in the root folder of the site?
    – Tim Clarke
    Nov 21, 2017 at 15:55
  • OK. I have put this into an otherwise blank php.ini in the root folder. Sadly it has made no difference.
    – Tim Clarke
    Nov 21, 2017 at 21:41
  • 1
    You should look at where Plesk causes Apache to look for php.ini files. Start by dropping a <?php phpinfo() ?> in some file in your webroot (like index.php) to get more info about which config file is being loaded, and what the value of expose_php is.
    – Gushi
    Nov 21, 2017 at 22:22

Not the answer you're looking for? Browse other questions tagged .