title: Hiding PHP's X-Powered-By header
body: <p>I know in PHP, it sends the <code>X-Powered-By</code> header to have the PHP version.</p>
  
  <p>I also know by appending some checksums, you can get access to PHP's credits, and some random images (<a href="http://www.0php.com/php_easter_egg.php" rel="noreferrer">more info here</a>).</p>
  
  <p>I also know in php.ini you can turn <code>expose_php = off</code>.</p>
  
  <p>But here is something I have done on a few sites, and that is use</p>
  
  <pre><code>header('X-Powered-By: Alex');
  </code></pre>
  
  <p>When I view the headers, I can see that it is now 'Alex' instead of the PHP version. My question is, will this send the previous PHP header first (before it reaches my <code>header()</code>, and is it detectable by any sniffer program? Or are headers 'collected' by PHP, <em>before</em> being sent back to the browser?</p>
  
  <p>By the way, this is not for security by obscurity, just curious how headers work in PHP.</p>