I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft. You can find two headers that will expose craft:
- "Set-Cookie": "CraftSessionId=".
- "X-Powered-By": "Craft CMS".
Thats concerns me because if any security vulnerability will be found on craft, than immediately my site could be more exposed to threats. also, it will be easier for attackers to plan an effective attack against my website, because using craft means that i use SQL, php, twig and more.
I understand that it helps spreading the word on the cms. But i thinks that in some cases it may be better to remove it.
I have two questions:
- Will it be against the terms and agreements of craft to remove those headers?
- Will writing a plugin for it be the best way, or maybe there is a better way?