• X-Powered-By (sent by PHP)
• X-Generator (sometimes sent by templates/extensions)

Why

Fingerprinting headers and meta tags make it trivial for automated scanners to identify your CMS/PHP version and target known vulnerabilities. Removing them is a small, low-risk hardening step (security through obscurity is not a substitute for keeping Joomla/PHP updated, but it does raise the bar for casual automated scanning).

> Note: this plugin deliberately does not touch X-Content-Type-Options. That header (nosniff) is a genuine security control, not a fingerprinting > leak — removing it would reduce security rather than improve privacy.

Features

• Remove the generator meta tag completely, or replace it with custom text
• Optional: also remove/replace the generator meta tag in the administrator backend (the HTTP headers below are always removed everywhere when enabled, regardless of this setting)
• Optional, independent toggles for X-Powered-By, X-Generator
• Headers are removed on onBeforeRespond — right before Joomla sends the HTTP response, so nothing set later by a component, plugin, or template slips through
• PSR-4, SubscriberInterface, DI container (services/provider.php)
• Uses concrete, typed Joomla event classes (BeforeCompileHeadEvent, BeforeRespondEvent) instead of the generic EventInterface — requires Joomla 5.0+, not compatible with Joomla 4
• English + Slovak (sk-SK) language files