Technologies

Why nginx publishes its version by default, the directive that stops it, and why directory listings on nginx are always an explicit configuration choice.

Why Apache's Server header names its version and modules by default, the directives that control it, and where directory listings on Apache come from.

The bundle path, data payload and header that reveal Next.js, what that proves, and the three defaults worth checking on a production Next.js site.

The bundle path and state payload that reveal Nuxt, what recognition proves, and why the public half of runtime config is the part worth reading.

The generator tag and island markup that reveal Astro, why the generator string carries a version, and what mostly-static output changes in an audit.

The ng-version attribute and application root that reveal Angular, why client-side rendering is the default, and what that means for indexing checks.

The session and XSRF-TOKEN cookies that reveal Laravel, why the XSRF cookie is readable by script on purpose, and why debug mode is the setting to verify.

The CSRF form field and cookie names that reveal Django, the cookie defaults that leave Secure off, and why DEBUG is the setting that must never ship on.

The CSRF meta tags and session cookie that reveal Rails, and why force_ssl is the single setting that governs HTTPS redirection and HSTS together.

The profiler headers, cookies and bundle paths that reveal Symfony, and why an X-Debug-Token header in production is a finding rather than a fingerprint.

Why a Werkzeug server header is the only strong sign of Flask, why it means the development server is facing the internet, and what the session defaults are.

The X-Powered-By header and connect.sid cookie that reveal Express, why they are the only evidence of Node.js on a server, and what Express advises about both.

The X-Powered-By header and PHPSESSID cookie that reveal PHP, why the header carries the exact version, and the session cookie flags that are off by default.

The version headers and __VIEWSTATE field that reveal ASP.NET, the IIS Server header and how it is removed, and what ASP.NET Core leaves to configuration.