Server software versions exposed
Effort to fix: Quick win (under an hour)
Why it matters
Exact version numbers in response headers let attackers match your stack to known vulnerabilities without any probing.
How to fix it
Remove version details from Server and X-Powered-By headers (Apache: ServerTokens Prod, Nginx: server_tokens off, PHP: expose_php = Off).
On WordPress
Set expose_php = Off in php.ini (or ask your host) to remove the PHP version from X-Powered-By.