X-Powered-By

Express enables this by default. From lib/application.js:

this.enable('x-powered-by');

Every response therefore carries X-Powered-By: Express.

the fix

app.disable("x-powered-by");

helmet also removes it, so if you use helmet this is already done. Helmet’s docs still suggest the explicit app.disable() line as well, since it stops the header being generated rather than stripping it afterwards.

verify it workedRun this in: http response

curl -sI https://example.com/ | grep -i x-powered-by

No output is the correct result.

Rated low, and here is the honest reason

Helmet’s own documentation says this plainly:

Removing the header offers very limited security benefits (see this discussion) and is mostly removed to save bandwidth, but may thwart simplistic attackers.

That is the package that removes the header telling you it barely matters. Version disclosure is not a vulnerability, and anyone running a scanner will fingerprint Express from its 404 body, its error format and its cookie names regardless.

It is on this checklist because it is genuinely free — one line, breaks nothing — not because it closes anything meaningful. Where the genre inflates this into a finding, the honest rating is low, and a compliance report that flags it is describing tidiness rather than risk.

The disclosure that actually matters on this site is stack traces in error responses, which leaks absolute paths and dependency versions rather than a single framework name.

before you ship this

Nothing. No client depends on this header.

Related

• Stack traces in error responses — the disclosure worth caring about
• Web servers have the same control (server_tokens in nginx, ServerTokens in Apache) and it is worth about the same there — version disclosure is not a vulnerability.