4

I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft. You can find two headers that will expose craft:

  1. "Set-Cookie": "CraftSessionId=".
  2. "X-Powered-By": "Craft CMS".

Thats concerns me because if any security vulnerability will be found on craft, than immediately my site could be more exposed to threats. also, it will be easier for attackers to plan an effective attack against my website, because using craft means that i use SQL, php, twig and more.

I understand that it helps spreading the word on the cms. But i thinks that in some cases it may be better to remove it.

I have two questions:

  1. Will it be against the terms and agreements of craft to remove those headers?
  2. Will writing a plugin for it be the best way, or maybe there is a better way?

Thanks ahead!

3

Will it be against the terms and agreements of craft to remove those headers?

Will writing a plugin for it be the best way

No to both questions – just add the following config values to your /config/general.php file:

'sendPoweredByHeader' => false,
'phpSessionName' => 'WhateverYouWant',

Also, check out this excellent post by Brad Bell on the topic of Craft and security.

  • 1
    wow, i thought it's gonna be more difficult, thanks for the help! – Samuel E. Jan 23 '16 at 18:34
  • 2
    It should be noted there are a dozen other (unavoidable) ways to figure out if a site is running Craft or not, so at best changing this is security by obscurity. – Brad Bell Jan 24 '16 at 4:38
  • @BradBell, obscurity is a good security. i guess you could find out what software the site uses in many ways, but i find Craft very easy to "cloak", so its much easier than in other softwares(at least for me). – Samuel E. Jan 25 '16 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.