Fix guide · low · generator_tag
Generator meta tag reveals CMS / framework
What this rule means
An <meta name="generator" content="..."> tag in your HTML reveals the CMS or framework name and version.
Why it matters
Useful for attacker fingerprinting. Common in WordPress, Drupal, Hugo, Gatsby — each has its own set of known CVEs and patches.
How to fix it
Remove the tag. CMS-specific:
- WordPress:
remove_action('wp_head', 'wp_generator');in functions.php - Drupal: edit themes / use a module to strip
- Hugo:
disableHugoGeneratorInject = truein config.toml - Gatsby: configure in gatsby-config.js
Did vibecheck flag this on your app?
If you reached this page from a vibecheck inspection report, the redacted match in your scan output is the exact string we found in your bundle. After applying the fix above, run the inspection again — the finding should clear.
Run another inspection