Why it matters
It doesn't make you vulnerable by itself, but it lets automated tools match you to known vulnerabilities in seconds.
How Patch checks
We read the Server and X-Powered-By headers on your homepage and flag ones that include a version number.
How to fix it
- Remove the version from your response headers. For example, set expose_php = Off in PHP, ServerTokens Prod in Apache, or server_tokens off in nginx.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.