DE

↑ ↓ select, Enter open, Esc close

Detect the web server and PHP version from HTTP headers

harmlessnginxalle
Adjust the values, the command updates live
user@server
curl -sI https://example.com/ | grep -iE "^(server|x-powered-by|via):"

Shows which server identifies itself (nginx, Apache, LiteSpeed) and whether PHP reveals itself and its version via X-Powered-By. On Plesk with the nginx proxy this shows nginx, even though Apache generates the page. Version numbers in these headers make it easier for attackers to look for known vulnerabilities.

Note: For nginx, server_tokens off; hides the version, for PHP use expose_php = Off in php.ini.

Also searched as

  • which web server is a site running
  • check if site uses nginx or apache
  • hide php version in header
  • check x-powered-by removed

Related one-liners

All in nginx

Check the browser caching headers of a file

$curl -sI https://example.com/wp-includes/css/dist/block-library/style.min.css | grep -iE "^(cache-control|expires|etag|last-modified|age):"
harmlessnginx

Check the X-Robots-Tag header of a URL

$curl -s -o /dev/null -D - https://example.com/ | grep -i '^x-robots-tag'
harmlessSEO checks

Check whether a website sends the HSTS header

$curl -sI https://example.com/ | grep -i "^strict-transport-security"
harmlessSSL and certificates

Compare the response time of a PHP page with a static file

$for u in https://example.com/ https://example.com/wp-includes/css/dist/block-library/style.min.css; do curl -o /dev/null -s -w "%{time_starttransfer}s TTFB $u\n" "$u"; done
harmlessImages and performance

Show the HTTP response headers of a website

$curl -sSI https://example.com/
harmlessNetwork

Check whether a website serves gzip or Brotli

$curl -s -o /dev/null -D - -H "Accept-Encoding: br, gzip" https://example.com/ | grep -i "^content-encoding"
harmlessnginx

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.