How to hide next.js version from tools like Wappanalyzer

[ivanafanasyeu]

Summary

Hi

I want to hide next.js version from Wappanalyzer, but even with:

...
const nextConfig = {
poweredByHeader: false,
...

it removed it from header, but still available in detecting version.
How to hide next.js version completely?

Additional information

No response

Example

No response

[icyJoseph]

I am guessing that, they are probably using window.next as well.

• How to remove nextjs version information #39488 (comment)

I ran yarn build, and then yarn start, I went to the browser, and window.next has the 14.2.5 version.

grep -rl '14.2.5' .next/static/chunks | xargs sed -i '' 's/14.2.5/xx.xx.xx/g' 

Then used I the code above, and yarn start again, without building, and went to the browser, cleared my cache, and reloaded the page, and now window.next shows xx.xx.xx :)

It might not be enough though, maybe Wappalyzer check the files names _next, or other heuristics.

[ivanafanasyeu]

looks like this one

async function c(e, t, n, c, f) {
            let d = {
                [r.RSC_HEADER]: "1",
                [r.NEXT_ROUTER_STATE_TREE]: encodeURIComponent(JSON.stringify(t))
            };
            f === a.PrefetchKind.AUTO && (d[r.NEXT_ROUTER_PREFETCH_HEADER] = "1"),
            n && (d[r.NEXT_URL] = n);
            let p = (0,
            u.hexHash)([d[r.NEXT_ROUTER_PREFETCH_HEADER] || "0", d[r.NEXT_ROUTER_STATE_TREE], d[r.NEXT_URL]].join(","));
            try {
                let t = new URL(e);
                t.searchParams.set(r.NEXT_RSC_UNION_QUERY, p);
                let n = await fetch(t, {
                    credentials: "same-origin",
                    headers: d
                })
                  , a = (0,
                o.urlToUrlWithoutFlightMarker)(n.url)
                  , u = n.redirected ? a : void 0
                  , f = n.headers.get("content-type") || ""
                  , h = !!n.headers.get(r.NEXT_DID_POSTPONE_HEADER);
                if (f !== r.RSC_CONTENT_TYPE_HEADER || !n.ok)
                    return e.hash && (a.hash = e.hash),
                    l(a.toString());
                let[g,m] = await s(Promise.resolve(n), {
                    callServer: i.callServer
                });
                if (c !== g)
                    return l(n.url);
                return [m, u, h]
            } catch (t) {
                return console.error("Failed to fetch RSC payload for " + e + ". Falling back to browser navigation.", t),
                [e.toString(), void 0]
            }
        }

[icyJoseph]

Is this a server action?

I am a bit worried that, this is a dead-end.

It works for a simple app, but as soon as you do more complex stuff, things break, and even if fixed, maybe Wappalyzer will still figure out that you use Next.js

[ivanafanasyeu]

no, I don't use any server actions.

I agree, on the side it might work only for simple app. Until it some request, you code is working in fact, version is xx.xx.xx now, but next.js could allow to do that in one line, because on vercel.com for example, version is hidden from Wappalyzer...

waiting for the response from them. Thank you for your time

[ivanafanasyeu]

I found a way, for more precise removing:

//mac os version
sed -i '' 's/version":"14\.1\.0"/version:""/g' .next/trace
grep -rlF 'version:"14.1.0"' .next/static/chunks | xargs sed -i '' 's/version:"14\.1\.0"/version:""/g'

//linux version
// remove next version from .next/trace
sed -i 's/version":"14\.1\.0"/version:""/g' .next/trace

// remove next version from window.next version
grep -rlF 'version:"14.1.0"' .next/static/chunks | xargs sed -i 's/version:"14\.1\.0"/version:""/g'

do it after the build step

[icyJoseph]

Great stuff, if you ever find an issue with such a switch, please do report back.

And I guess, the biggest question... did it help? Does Wappalyzer not see Next.js?

[ivanafanasyeu]

yes, with those scripts, wappalyzer do not see next.js

[gogulraj-encipherhealth]

I have an issue with my application exposing the Next.js version through Wappalyzer. How can I resolve it?

[MHBahrampour]

Thanks to @ivanafanasyeu’s solution I was able to remove the Next.js version successfully.
However, a few files still contained the version string. I updated the script to handle those cases and made it more dynamic so it works reliably in GitLab pipelines and Docker builds.

Improvements I made

• Dynamically detects the installed Next.js version from node_modules/next/package.json, ensuring it matches the version actually used in the build.
• Cleans all .next artifacts (.next/static, .next/server/chunks, .next/diagnostics, etc.) where the version might appear.
• Idempotent and safe: does not fail if the version is already stripped or not found.
• Pipeline- and Docker-friendly: runs reliably in CI/CD environments without manual intervention.
• Provides clear logs showing which version was removed and how many files were affected.

Final solution

1. Create a scripts/strip-next-version.sh file at the project root:

#!/bin/sh
set -e

echo "[postbuild] Stripping Next.js version from .next artifacts for security…"

# Get the actual installed Next.js version
NEXT_VERSION=$(node -p "require('./node_modules/next/package.json').version" 2>/dev/null || echo "")

if [ -z "$NEXT_VERSION" ]; then
  echo "[postbuild] ⚠️ Could not detect Next.js version. Skipping strip step."
  exit 0
fi

# Find all files containing the version
FILES=$(grep -rlF "$NEXT_VERSION" .next || true)

if [ -z "$FILES" ]; then
  echo "[postbuild] ✅ No occurrences of $NEXT_VERSION found in .next."
  exit 0
fi

# Replace version with empty string
echo "$FILES" | xargs sed -i "s/$NEXT_VERSION//g"

echo "[postbuild] ✅ Removed Next.js version $NEXT_VERSION from $(echo "$FILES" | wc -l) files."

2. Make the script executable:

chmod +x scripts/strip-next-version.sh

3. Add the script as a postbuild command in package.json. This way it runs automatically after build command:

"scripts": {
  "build": "next build --turbopack",
  "postbuild": "./scripts/strip-next-version.sh",
},

If everything works correctly, you’ll see output like this after the build:

○  (Static)   prerendered as static content
ƒ  (Dynamic)  server-rendered on demand


> [email protected] postbuild
> ./scripts/strip-next-version.sh

[postbuild] Stripping Next.js version from .next artifacts for security…
[postbuild] ✅ Removed Next.js version 15.5.2 from 42 files.

Note 1: If your team works on different OSs (especially Windows) you may need to handle executable permission more gracefully. Like this:

git add --chmod=+x scripts/strip-next-version.sh

Note 2: These commands and scripts are written for the Bash shell, if you use other shells you may need to update accordingly. I personally use the Fish shell and haven’t encountered any issues.