Magento 2 remove version number impact

Question

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it.

to prevent this I can disable the magento_version module from command line but not sure disabling this module will impact on any other feature. In code I noticed they are only using controller to display the info. But i am not sure it's used elsewhere or not. Also, possible magento use it for API or something or for composer based upgrades?

Will there be any negative impact if we disable? Should i hide my version number publicly? Is it good to hide it?

Any help would be appreciated.

Answer 1

This was news to me

https://www.atwix.com/magento-2/hide-version/

php bin/magento module:disable Magento_Version

I can't think of anything negative

Answer 2

for hackers version detection is not from that url, they have files hashes to scan your shop to get magento version with 95% accuracy. and so the same way they scan for any vulnerabilities.

what you need to do is to monitor your access log for any suspicious access pattern.

also there are nginx configs that block any basics, and if you add some secutiry monitoring tool like for example OSSEC(pretty noisy) with EKL stack, you can adjust your servers rules in real time.

so the answer - dont hide version - change it in module or using html/url rewrite. this will keep "kiddies" a bit confused.