Disabling the X-Powered-By flag

If your organization is concerned that the X-Powered-By flag in the header variable is a security risk, you can disable it using this procedure.

Procedure

  1. If you are using WebLogic, in the administration console, under domainName > Configuration > Web Application, set X-Powered-By Header to X-Powered-By Header will not be sent.
  2. If you are using WebSphere®, perform the following steps.
    1. In the WebSphere® administration console, navigate to Servers > Server Types > WebSphere application servers > server_name > Web Container Settings > Web container.
    2. Under Additional Properties select Custom Properties.
    3. On the Custom Properties page, click New.
    4. On the Settings page, create a custom property named com.ibm.ws.webcontainer.disablexPoweredBy and set the value to false.
    5. Click Apply or OK.
    6. Click Save on the console task bar to save your configuration changes.
    7. Restart the server.