Hide the PHP version header

You hide the PHP version header by setting expose_php to Off so the server stops sending X-Powered-By. On shared hosting that change is made in cPanel MultiPHP INI Editor for the domain you care about. On a VPS you edit the php.ini that the site actually uses, then confirm with a simple header check.

Set expose_php to Off

Open cPanel and go to MultiPHP INI Editor. Choose the domain or the PHP version that serves that domain. Set expose_php to Off and save the change so the vhost picks it up.

On a VPS with root access, edit the php.ini tied to that site’s PHP handler rather than a CLI copy you might open by habit. LiteSpeed on our shared platform does not need to advertise PHP in the response. After you save, give the change a moment and move on to a header check from outside the account.

Confirm the header is gone

From any machine that can reach the site, request headers only and look for X-Powered-By. An empty result for that name is what you want.

curl -sI https://example.com | grep -i x-powered-by

If the line still shows something like PHP/8.x, you likely edited the wrong INI file, or a plugin is adding the header after PHP runs. Remove or reconfigure that plugin, or unset the header once at the LiteSpeed vhost level. One clean unset is enough; stacking several security plugins that each touch the same header only adds noise.

1. Set expose_php = Off for the correct vhost or MultiPHP profile.
2. Run the curl check and confirm X-Powered-By no longer appears.
3. If a plugin re-adds it, remove that behavior or unset the header in LiteSpeed.
4. Update outdated plugins and themes next, because that work matters more than the banner.

What this change does and does not cover

Hiding the version header reduces easy banner-driven probes. It is not a full security control on its own. Scanners can still infer a stack from generator tags, public readme files, error output, or a forgotten phpinfo page.

WordPress often exposes itself through a generator meta tag and files such as readme.html. You can delete readme and license files you do not serve, and a small plugin can strip the generator tag if you want a quieter front page. Turn display_errors off in the same INI pass so fatal errors do not print version details to visitors.

After the curl check is clean, review xmlrpc exposure and your plugin list. A hidden PHP version with an abandoned plugin is still an abandoned plugin. Keep the header tidy, then spend the rest of your time on updates and basic hardening.