Hello. There is a need that when analyzing the site, the display of the CMS was not modx, but another. Can this be implemented somehow?
You could try setting the system setting send_poweredby_header to Yes. I don’t know if this helps though.
Hello. As far as I understand, this will indicate, on the contrary, that MODX is being used. And you need something to show, for example
WordPress or nothing at all
Disabling the setting Harry mentions will remove the header (if it’s currently being sent), but that may not necessarily affect what such analysis services think your site uses.
There are different ways to fingerprint a MODX site, the header is just the easiest one.
–
I will add that if this desire to not have your MODX site identifiably as MODX comes from a security point of view: security through obscurity is not security. Keeping your site up-to-date is 100 times more important.
If you want to use a plugin to add a different header and add a bunch of junk to your template to fool people into thinking it’s WordPress, knock yourself out… just don’t forget about the basics first.
2 Likes
My guess is that the services look for WordPress before MODX, since it’s much more common. If you scatter a few key WordPress files in the locations where they appear in WP, and add a “Powered by WordPress” comment in the HTML of your header, that may be enough to disguise the site. Though a quick analysis of the MODX index.php file (even if you rename it) will still reveal the site as using MODX. You could mangle the index.php file, but you’d have to do it again every time you upgrade MODX.
Hello. This is because modx is not allowed to be used in a number of industries due to political situations. and we love modx and are looking for an option how to get around this problem
Interesting. I’d be curious to know what country you’re in.
It’s difficult to know what to suggest without knowing the technique the authorities are using to identify MODX sites. since there are so many different ways of doing it.
Can you post the text from that link that indicates that yours is a MODX site. I tried it on a couple of MODX sites of mine and didn’t see any reference to MODX.
Be sure the send_poweredby_header System Setting is set to No.
I was hoping it would give some clue to how it knew.
I don’t know why my MODX sites are not showing that, but it suggests that it’s possible to avoid it.
I assume you have the poweredby System Setting off, but have you manually deleted all files in the core/cache directory since you turned it off?
Another thought. Go into PhpMyAdmin, select your database, and use the search tab to search for MODX. See if it appears in any chunks, templates, TVs, or resources.
I’d image these sites will look for other clues to ID the CMS as well as just checking the poweredby setting.
For instance, confirming the existing of /manager/index.php and examining the markup would give MODX away in the blink of an eye - unless the manager login page was moved or otherwise altered beyond recognition.
I think there are other publicly accessible files which could ID MODX - presumably they know where to look for these.
Hello. Thanks. I will try
Hello. I think this is a formality for the inspectors and no one will go deeper