<blockquote>
<p>Will it be against the terms and agreements of craft to remove those headers?</p>
<p>Will writing a plugin for it be the best way</p>
</blockquote>
<p>No to both questions – just add the following <a href="https://craftcms.com/docs/config-settings" rel="nofollow noreferrer">config values</a> to your <code>/config/general.php</code> file:</p>
<pre><code>'sendPoweredByHeader' =&gt; false,
'phpSessionName' =&gt; 'WhateverYouWant',
</code></pre>
<p>Also, check out <a href="https://craftcms.stackexchange.com/a/4449/1098">this excellent post by Brad Bell</a> on the topic of Craft and security.</p>

CC BY-SA 3.0
2016-01-23T18:34:40.403Z
wow, i thought it's gonna be more difficult, thanks for the help!
Samuel E.
CC BY-SA 3.0
2016-01-24T04:38:53.703Z
It should be noted there are a dozen other (unavoidable) ways to figure out if a site is running Craft or not, so at best changing this is security by obscurity.
Brad Bell
CC BY-SA 3.0
2016-01-25T11:27:23.763Z
@BradBell, obscurity is a good security. i guess you could find out what software the site uses in many ways, but i find Craft very easy to "cloak", so its much easier than in other softwares(at least for me).
Samuel E.
CC BY-SA 3.0
2016-01-23T18:23:43.930Z
2016-01-23T18:23:43.930Z
2020-06-17T08:56:27.903Z
Mats Mikkel Rummelhoff
<p>I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft.
You can find two headers that will expose craft:</p>

<ol>
<li>"Set-Cookie": "CraftSessionId=".</li>
<li>"X-Powered-By": "Craft CMS".</li>
</ol>

<p>Thats concerns me because if any security vulnerability will be found on craft, than immediately my site could be more exposed to threats. also, it will be easier for attackers to plan an effective attack against my website, because using craft means that i use SQL, php, twig and more.</p>

<p>I understand that it helps spreading the word on the cms. But i thinks that in some cases it may be better to remove it.</p>

<p>I have two questions:</p>

<ol>
<li>Will it be against the terms and agreements of craft to remove those headers?</li>
<li>Will writing a plugin for it be the best way, or maybe there is a better way?</li>
</ol>

<p>Thanks ahead!</p>

<security>
Removing x-powered-by and changing cookies names for security?
# Removing x-powered-by and changing cookies names for security?

(Asked by: username_0 on 2016-01-23)

I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft.
You can find two headers that will expose craft:

1. "Set-Cookie": "CraftSessionId=".
2. "X-Powered-By": "Craft CMS".

Thats concerns me because if any security vulnerability will be found on craft, than immediately my site could be more exposed to threats. also, it will be easier for attackers to plan an effective attack against my website, because using craft means that i use SQL, php, twig and more.

I understand that it helps spreading the word on the cms. But i thinks that in some cases it may be better to remove it.

I have two questions:

1. Will it be against the terms and agreements of craft to remove those headers?
2. Will writing a plugin for it be the best way, or maybe there is a better way?

Thanks ahead!

**Tags:** security

---

## 1 answers

### Answer by username_1 on 2016-01-23. Score: 3 | Accepted answer

Will it be against the terms and agreements of craft to remove those headers?
Will writing a plugin for it be the best way

No to both questions – just add the following config values to your /config/general.php file:
'sendPoweredByHeader' => false,
'phpSessionName' => 'WhateverYouWant',

Also, check out this excellent post by Brad Bell on the topic of Craft and security.

> **Comments:**
> **username_0**: wow, i thought it's gonna be more difficult, thanks for the help!  
> **username_2**: It should be noted there are a dozen other (unavoidable) ways to figure out if a site is running Craft or not, so at best changing this is security by obscurity.  
> **username_0**: @BradBell, obscurity is a good security. i guess you could find out what software the site uses in many ways, but i find Craft very easy to "cloak", so its much easier than in other softwares(at least for me).  

---

