Express: Node.js application framework

What Express is

Express is the long-standing minimal web framework for Node.js and sits underneath a large number of APIs and server-rendered applications. It advertises itself in a response header by default, which is why it is so often visible on APIs that expose nothing else.

How DNSTrace.dev detects it

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

x-powered-by: Express — Emitted by default and removed with a single configuration line, so its absence proves nothing.

What a detection proves

The response was produced by an Express application, or by a framework built on top of Express that did not disable the header.

What it does not prove

Which higher-level framework is in use, the Node.js version or the hosting platform. Many frameworks build on Express and inherit this header.

Common questions

Is x-powered-by: Express a security problem?

It is minor information disclosure rather than a vulnerability. It is commonly disabled because it offers no benefit to visitors.

Why do so many APIs show Express?

Express is a default choice for Node.js services and the header is on unless explicitly turned off, so it surfaces on endpoints that expose no other framework signal.