Registry / web-framework / hide-powered-by

hide-powered-by

library1.1.0jsnpmunverified

Simple middleware to remove or spoof the X-Powered-By HTTP header. Version 1.1.0 is stable with minimal maintenance. Part of the Helmet.js security middleware family. Differentiates from alternatives by allowing custom header values to mislead attackers. Removing X-Powered-By only obfuscates the framework and is not a strong security measure.

web-framework auth-security

npm install hide-powered-by

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · HIDE-POWERED-BY

hide-powered-by

web-frameworkjavascriptv1.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

hidePoweredBy

✓ import hidePoweredBy from 'hide-powered-by'

✗ const hidePoweredBy = require('hide-powered-by')

ESM import is preferred; CommonJS require also works in CJS environments.

hidePoweredBy

✓ const hidePoweredBy = require('hide-powered-by')

✗ import { hidePoweredBy } from 'hide-powered-by'

The package exports a single default function, not a named export.

HidePoweredByOptions

✓ import type { HidePoweredByOptions } from 'hide-powered-by'

✗ import { HidePoweredByOptions } from 'hide-powered-by'

This is a TypeScript type export; use import type or skip if not using TS.

Demonstrates how to use hide-powered-by middleware with Express to remove or spoof the X-Powered-By header.

import express from 'express'; import hidePoweredBy from 'hide-powered-by'; const app = express(); // Remove X-Powered-By header app.use(hidePoweredBy()); // Or set to a custom value app.use(hidePoweredBy({ setTo: 'PHP 4.2.0' })); app.get('/', (req, res) => { res.send('Hello World!'); }); app.listen(3000, () => console.log('Server running on port 3000'));

Debug

Known issues

gotchaRemoving X-Powered-By is not a strong security measure; it only obfuscates the framework.

fix

Consider additional security headers like Helmet's other middleware.

affects: >=1.0.0

gotchaIf using Express, you can simply use app.disable('x-powered-by') instead of this middleware.

fix

Use app.disable('x-powered-by') for Express apps.

affects: >=1.0.0

gotchaThe middleware sets the header to '' (empty string) by default, which may still expose the header.

fix

If you want to remove the header entirely, ensure your framework supports removing headers.

affects: >=1.0.0

Errors

Common errors & fixes

Cannot find module 'hide-powered-by'

Package not installed

fix

npm install hide-powered-by

TypeError: hidePoweredBy is not a function

Incorrect import: using named import instead of default

fix

Change import to `import hidePoweredBy from 'hide-powered-by'` or `const hidePoweredBy = require('hide-powered-by')`

Property 'setTo' does not exist on type '{ setTo?: string | undefined; }'

TypeScript type mismatch

fix

Use typed options: `import type { HidePoweredByOptions } from 'hide-powered-by'` and pass options as `HidePoweredByOptions`.

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

18 hits · last 30 days

node

Anthropic

OpenAI (training)

Resources

githubhttps://github.com/helmetjs/hide-powered-by ↗

packagehttps://www.npmjs.com/package/hide-powered-by ↗

homepagehttps://helmetjs.github.io/docs/hide-powered-by/ ↗