X-Powered-By on 27 homepages: five send it, and 25 name their stack somewhere

FIELD TEST · 2026-09-03 · 27 homepages · one request each · stack disclosure in headers and HTML

Sample and method: 30 homepages fetched once each on 2026-09-03 with a desktop Chrome user agent, redirects followed, no JavaScript executed, exit node in Osaka, Japan. Three dropped out — stackoverflow.com, medium.com and www.reddit.com each returned 403 — leaving 27.

Five of the 27 homepages send an x-powered-by header. That number is the small one. Counting all three places a site can name its own stack — that header, the Server header, and <meta name="generator"> — 25 of 27 name a vendor or a framework, and 6 of them include a version or build identifier. One unauthenticated GET is enough to read all of it.

How we measured it

One GET per site, desktop Chrome user agent rather than Googlebot, redirects followed. The panel returned 581 response headers in total, an average of 21.5 per site. From each response we read X-Powered-By and Server, then pulled the <meta name="generator"> tag out of the delivered HTML with a regular expression.

# The same three readings on one of your own pages
curl -sI -A 'Mozilla/5.0' https://example.com/ | grep -iE '^(server|x-powered-by)'
curl -sL -A 'Mozilla/5.0' https://example.com/ | grep -io '<meta[^>]*generator[^>]*>'

Three limits. A homepage is one route, and an origin can answer differently under a path a CDN does not cache. We read what is disclosed; we did not try to do anything with it, and none of these values is a vulnerability by itself. And the panel is 27 large sites, so this describes a well-resourced slice of the web rather than the web.

Which sites send an x-powered-by header

Five, and three of them name the same framework.

MDN is blunt about what the header is: "The HTTP X-Powered-By response header is a non-standard header for identifying the application or framework that generated the response", and "Not part of any current specification" (X-Powered-By, read 2026-09-03). None of the five values carries a version number. Vercel's is the only one naming two things at once, a framework and a content backend.

The Server header is where most of the naming happens

23 of 27 send a Server header. Seven of those say cloudflare, four say Vercel, three say nginx, and the remaining nine are each unique: Google Frontend, github.com, railway-hikari, Apache, BBC-GTM, Framer/cc760a6, Netlify, envoy and ATS/9.2.15.

Four sites send no Server header at all: webflow.com, www.theverge.com, www.figma.com and arstechnica.com. Two of those four give themselves away in the body instead, which is the pattern this survey kept running into.

The generator tag is the rarest surface and by far the most specific one. Six sites ship it, five of those with a version or build string: Framer b1d1ca8, Astro v5.18.2 on www.netlify.com, WordPress 6.9.7 on techcrunch.com, Astro v6.3.7 on www.cloudflare.com and Astro v7.2.9 on astro.build. Only webflow.com writes a bare product name with nothing after it.

Three of those are the same framework on three different major versions, readable from outside with no login: Netlify on 5, Cloudflare on 6, Astro's own site on 7.

The quietest site on the panel still names its CMS

Two sites send none of the routing or platform headers we looked for — not Server, not Via, not X-Served-By, not X-Powered-By: webflow.com and arstechnica.com. Webflow then writes <meta name="generator" content="Webflow"> into the HTML, so the silence lasts exactly as far as the response headers.

That leaves arstechnica.com as the only site on this panel disclosing nothing in headers and nothing in a generator tag. It discloses more than either of them somewhere else. Its speculation rules script — the subject of speculation rules on 27 homepages — excludes paths matching /wp/wp-*.php, /wp-content/plugins/* and /wp-content/themes/ars-v9/*. That names the CMS, the plugin directory and the theme's internal name, inside a performance feature nobody thinks of as a disclosure surface.

Removing a header does not make a stack private. It moves the evidence into a file nobody audits.

What this means for your site

None of this changes how you are crawled or ranked. There is no ranking data in this measurement, and neither MDN nor Google's crawling documentation ties these headers to search. What it changes is how quickly a stranger can describe your setup.

1. Read your own three surfaces before deciding anything. The commands above take under a minute, and most people are surprised by the generator tag rather than the header.
2. Strip version numbers before you strip names. Astro tells someone what you build with; Astro v5.18.2 tells them which advisories to check.
3. Check the places that are not headers. Build manifests, error pages, feed generators and — as above — speculation rules blocks all leak names that a header policy never touches.

If your platform decides these values for you and gives you no setting, that constraint is the subject of what website builders will not let you change, and another header this same panel disagreed about is measured in CDN cache status across 27 homepages. To read the full header set and delivered HTML your own pages return on a plain fetch, see how QueryWin reads a page.

Common questions

How did you measure this?

One GET per homepage on 2026-09-03, desktop Chrome user agent, redirects followed, all 581 response headers recorded and lowercased. The generator tag was pulled from the delivered HTML with a regular expression. No JavaScript ran. Exit node in Osaka, Japan.

Should I remove the X-Powered-By header?

It costs nothing to remove and buys nothing to keep, since it is not part of any specification and no client depends on it. Whether removing it helps you depends on what else names the same framework, which is the point of reading all three surfaces first.

Does any of this affect SEO?

Not that this data can show. We collected no ranking information of any kind, and these headers are not crawl directives. A site that strips all of them ranks exactly as it did before.

Is disclosing the framework a security problem?

We do not know, and this survey cannot answer it. Nothing here was tested against a real target. The defensible statement is narrower: version strings shorten the distance between reading a page and knowing which advisories apply to it.

Why count the generator tag alongside headers?

Because two of the four sites with no Server header still name their stack — webflow.com in the HTML, www.theverge.com in a different header. Counting one surface at a time reports sites as quiet that are not.