On October 19, 2021, we have enabled single-sign-on for our Plesk Support Center to provide a seamless login/account experience. This implies that you’ll be able to use a single account across any of our web-facing properties.
If you had already registered your account at Plesk 360 (formerly known as My Plesk) please use one for login. Otherwise please re-register it using the same email address as your existing Zendesk login (support account). It’s essential that you use the same email address on our support center to ensure that your tickets stay attached to the same account.

Articles in this section

See more

How to remove/modify the header X-Powered-By for all websites hosted in Plesk for Linux?

Avatar
Mikhail Shport
Updated
Follow
Plesk for Linux kb: how-to ABT: Group B

Applicable to:

  • Plesk for Linux

Question

How to remove/modify the header X-Powered-By for all websites hosted in Plesk for Linux?

# curl -I https://example.com
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 01 Jun 2017 00:00:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PleskLin

Answer

Note: This solution is available starting from Plesk Obsidian 18.0.31:
How to update Plesk Obsidian to the latest build

  1. Install the extension Panel.ini editor to manage Plesk settings

  2. Go to Extensions > My Extensions > Panel.ini Editor (the Open button) > the Editor tab add the following lines at the end of the file:

    CONFIG_TEXT: [webserver]
    xPoweredByHeader = off

  3. Click the Save button

  4. Go to Tools & Settings > Diagnose & Repair and click repair for "Web & FTP Servers" to rebuild web server configuration.

Note: The same can be done via SSH by editing the file /usr/local/psa/admin/conf/panel.ini

The following examples describe how to remove/modify the X-Powered-By header for Plesk versions below 18.0.31:

Warning: This guide is intended for Plesk administrators with SSH access to the server. If you are a domain owner, please contact your service provider for assistance with removing/changing the headers.

Removing the X-Powered-By header: For a single domain

Note: The following steps are only working with Apache. When Nginx is installed, it's possible to modify the panel.ini file as described in the previous accordion to disable the header server-wide.

  1. Log in to Plesk GUI

  2. Go to Domains > example.com > Apache & Nginx Settings > Add the following directive in Additional directives for HTTP and Additional directives for HTTPS > Click OK to apply changes:

    CONFIG_TEXT: Header unset X-Powered-By

Changing the X-Powered-By header

  1. Connect to a Plesk server via SSH.

  2. Create a directory for custom templates:

    # mkdir -p /usr/local/psa/admin/conf/templates/custom/domain

  3. Copy default templates to the created directory:

    # cp /usr/local/psa/admin/conf/templates/default/server.php /usr/local/psa/admin/conf/templates/custom

    # cp /usr/local/psa/admin/conf/templates/default/domain/nginxDomainVirtualHost.php /usr/local/psa/admin/conf/templates/custom/domain

    # cp /usr/local/psa/admin/conf/templates/default/domain/nginxForwarding.php /usr/local/psa/admin/conf/templates/custom/domain

  4. Modify custom templates:

    Note: If you want to use two or more words separated by space in the X-Powered-By header (For example, X-Powered-By: My custom header), put these words in quotes. Otherwise, the following error will appear: Template_Exception: nginx: [emerg] invalid number of arguments in "add_header" directive.

    • Open the file /usr/local/psa/admin/conf/templates/custom/server.php in a text editor (for example, vi editor) and change the value of the X-Powered-By header to your own. Save the changes and close the file.

    • Open the file /usr/local/psa/admin/conf/templates/custom/domain/nginxDomainVirtualHost.php in a text editor and change the value of the X-Powered-By header to your own. Save the changes and close the file.

    • Open the file /usr/local/psa/admin/conf/templates/custom/domain/nginxForwarding.php in a text editor and change the value of the X-Powered-By header to your own. Save the changes and close the file.

  5. Verify the changes. The output should look as follows:

    # grep -ir X-Powered-By /usr/local/psa/admin/conf/templates/custom

    /usr/local/psa/admin/conf/templates/custom/domain/nginxDomainVirtualHost.php: add_header X-Powered-By "My custom header";

    /usr/local/psa/admin/conf/templates/custom/domain/nginxForwarding.php: add_header X-Powered-By "My custom header";

    /usr/local/psa/admin/conf/templates/custom/server.php: Header add "My custom header"

    Rebuild configuration files of all domains:

    Note: If there are 300+ domains on the server, run this command during the maintenance hours.

    # /usr/local/psa/admin/sbin/httpdmng --reconfigure-all

  6. Verify that the header has been changed:

    # curl -I http://example.com

    OR

    # curl -I https://example.com

Related Articles

Comments

14 comments

Sort by Date Votes
  • Avatar
    Daniel (Edited )

    "Removing the X-Powered-By header"

    This method does not work for me. I still recieve the X-Powered-By header...

     

    Eather it's a painful work if you have a lot of domains. You should implement a toggle to hide this header same with php x-powered-by header, for security reasons, or just keep them away...

    2
    Comment actions Permalink
  • Avatar
    Anzhelika Khapaknysh

    @Daniel Thanks for the feedback!
    I've checked instructions on the test server and it works for me. Please provide more details. Have you reconfigured domains as per step 7?

    0
    Comment actions Permalink
  • Avatar
    Unknown User

    If i have my custom templates, e.g. /usr/local/psa/admin/conf/templates/default/server.php

    Will I have problems with future Plesk updates?

    Or could it be that I will not benefit from further improvements?

     

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello @Tobias,

    Having a custom template is not an obstacle for future updates.

    In case you will have any issue, feel free to contact Plesk Technical Support.

    0
    Comment actions Permalink
  • Avatar
    Josef Glatz (Edited )

    Thanks for that article! Works as described in Onyx 17.8.11 on Ubuntu

     

    Beside that: It would be very very nice if Plesk can include a toggle in the website config GUI to disable such headers also when nginx works as proxy in front of apache

    1
    Comment actions Permalink
  • Avatar
    Artyom Baranov

    @Josef Glatz,

    Hello! Thank you for the feedback.

    You may share your idea on a special resource: https://plesk.uservoice.com/forums/184549-feature-suggestions

    0
    Comment actions Permalink
  • Avatar
    Christian Heutger

    Are you sure, that your guide above is correct? Why should I remove

    <?php foreach ((array)$VAR->domain->physicalHosting->headers as list($name, $value)): ?>
    add_header <?=$VAR->quote([$name, $value])?>;
    <?php endforeach ?>

    and not only the line

    add_header X-Powered-By PleskLin;

    in /usr/local/psa/admin/conf/templates/custom/domain/nginxDomainVirtualHost.php?

    It looks like the lines above set all other headers chosen in the GUI and last one just set the X-Powerd-By header? So if removing all 4 lines, no own set headers will be written as well?

    0
    Comment actions Permalink
  • Avatar
    Nikita Nikushkin

    Hello @Christian Heutger,

    Thank you for the feedback!

    The article was reworked

    0
    Comment actions Permalink
  • Avatar
    Patrick Jansen

    I followed the whole procedure, including " /usr/local/psa/admin/sbin/httpdmng --reconfigure-all " (twice) and still see "X-Powered-By".   Diagnose & Repair says 

    WARNING Checking for custom configuration templates Some custom configuration templates have been found. The custom templates have higher priority than default templates in case of configs generation Please check documentation for details: https://docs.plesk.com/current/redirect.html?book=advanced-administration-guide-linux&page=68693.htm

    Restarted everything, but nope :-(. 

    Any help?  A security officier from customer wants us to remove it. 

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello Patrick Jansen

    This warning is expected because a custom template is created in the proposed steps.

    The most probable cause is that templates were sent incorrectly. Make sure that all 3 rows were removed in all 3 files as per the instruction.

     

    In case this still won't work for you, consider submitting a support request.

    0
    Comment actions Permalink
  • Avatar
    Tobias Buschor

    Pleas vote here if you like it:

    https://plesk.uservoice.com/forums/184549-feature-suggestions/suggestions/37632988-easy-removal-x-powered-by-http-headers

    0
    Comment actions Permalink
  • Avatar
    Linus

    This new panel.ini feature is first available on Plesk 18.0.31.

    For older Plesk Obsidian versions like 18.0.30 there should be still the old guide to copy the webserver templates. 

    0
    Comment actions Permalink
  • Avatar
    HKFYG

    May I know how to remove "Location" in header?

    0
    Comment actions Permalink
  • Avatar
    TomBob

    works - but doesn't show in the panel.ini as an option under viewer.

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles