Because hiding version information is a weak security measure and a form of security through obscurity. The amount of security it adds is debatable, given that a) attackers can still fingerprint and probably determine your server, version and mods within a narrow margin of error and b) attackers can simply throw their whole library of exploits at you anyway.
As said, it's not a security issue to leave it, and it's a useful information for some client programs. Take curl for instance: it uses the Server header value to check if HTTP pipelining can be enabled:
Taken from https://serverfault.com/a/596560/347610
[curl shows this message when run in verbose mode -v]:
* Server Apache/... is not blacklisted
Historically, many servers returned headers like this:
Server: Apache/2.4.1 (Unix) mod_php/1.2 mod_ssl/0.9
This does give away a bit more information than you want, so most servers now default to headers like this:
In fact, most web servers make it difficult to turn off this header. The reason? Marketing. They want to appear in surveys ...
Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database at all. In the same manner, they probably probe for security holes in every version of, e.g., apache. Lying on or omitting the Server header does not buy you ...
Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit.
Even if you don't advertise it, it can be figured out from the behaviour of the app. Take for example, the network scanning tool nmap:
Nmap provides a number of features for probing computer networks, including host discovery and ...
Yes, if you store access credentials for your server in Gitlab, and Gitlab gets hacked, then your server may get hacked. If the user who is deploying your application needs root access, then you have no choice but to give root access to gitlab (or adjust your application so root access isn't necessary).
User access level
You seem to be ...
AND 1=1 is a common SQL Injection payload to select all results of an SQL query since it always evaluates to true.
It being sent along with the URL can be for numerous reasons, but it might be an indicator for an SQL Injection vulnerability if the URL parameter is directly fed into an SQL statement and is not properly sanitized beforehand.
To disable Protocols create a Client and a Server key with the protocol version and add the DisabledByDefault = 1 (DWord) and Enabled = 0 (DWord) values.
Examples or keys:
Even though you developed your code with security and privacy by design, audited the result and have continuously monitored CVEs to be sure that there are no (known) issues that affect you, that doesn't mean everyone else has, too. Presumably you're in a shared hosting or VPS environment: your hosting company is in the business of providing a secure OS, ...
Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered.
Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018.
So, can we say it is "fairly safe" to run an outdated PHP ...