FG Remove Generator hides Joomla and PHP fingerprints

Sites encounter this issue because default responses can reveal that Joomla, PHP, or an extension is in use. That information does not replace a vulnerability, but it gives automated scanners useful clues about what to probe.

Joomla does not provide a general administrator setting for disabling the generator tag or these response headers. A developer can alter the document head with a template override or custom plugin, while web-server and PHP configuration can handle some headers. FG Remove Generator takes the system-plugin route: according to the listing, it can remove or replace the generator metadata, including separately in the administrator area, and can independently remove or replace X-Powered-By and X-Generator. The listing says those header changes are applied just before the response is sent. It deliberately leaves X-Content-Type-Options alone.

This is aimed at site owners or agencies applying a small amount of response hardening across Joomla 5 or 6 installations without maintaining their own plugin or template override. A site that already controls these values at the web-server level, or that has no concern about exposing its software stack, has little reason to add it. It is not a substitute for updating Joomla and PHP.

The directory lists it as a free download in SEO & metadata, under developer ferino. The developer has three other extensions listed, while this entry has no reviews. Before installing, check the documentation and update path, confirm which headers your hosting stack actually emits, and verify whether replacing values is preferable to removing them. The listing does not state support arrangements, hosting-server requirements, or whether its claimed behavior has been tested with particular third-party templates and extensions.

Listed on the Joomla Extensions Directory.