Forum Moderators: coopster

Message Too Old, No Replies

X-Powered-By: PHP/x.x.x

Why shouldn't I remove it, whats its purpose?

         

twist

6:31 pm on May 30, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I notice this header in WW is X-Powered-By: BestBBS v3.33

I have read through various threads on how to remove or change it but why would I want it in the first place, what purpose does it serve?

I have removed all the extensions from my pages because of something I read about security through obscurity but it's kinda of pointless when the headers plainly give it away. Any thoughts on preferred methods of removal or cloaking? I think it would be fun to give it my own name like X-Powered-By: ME!

What would be the best way to change the text?

Blackie

6:59 am on May 31, 2005 (gmt 0)

10+ Year Member



The purpose is to credit the people spending hours to develop something they give away for free. Makes any sense? :-)

rogerd

10:46 am on May 31, 2005 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



If I'm understanding the question, Twist, you aren't referring to BestBBS (which isn't a commercial product yet), but other software that puts a "powered by" note into page titles or other content?

Assuming that to be the case... stripping that info out (if permitted by your license) may involve editing templates (header or page template, for example) or perhaps using the software's control panel. I'm guessing you'll have to hack up the templates.

I'm a believer in eliminating obvious software footprints, and have paid extra license fees to remove copyright notices legally from software I use.

twist

8:17 pm on May 31, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Ok, after a little more research. First off, there is an option to turn this off so I doubt the people at PHP would be offended.

I am not sure if this website article is ok to post but it pretty much covers my concerns,

[itworld.com...]

An attacker who has developed an exploit for the recent PHP bug need only consult her list of machines with PHP installed to begin hitting a number of likely targets.

Why leave yourself open for an attack if you don't have to and besides this information is in the header, no regular user has any good reason to read your headers.