Why is there sometimes a value of X-Powered-By in the header of an HTTP request and sometimes not?

x-powered-by is not output by Apache or Nginx, but output by a language parser or application framework. The meaning of this value is used to tell what language or framework the website is written in.
For example:

• php

PHP standard output is:

• If you use ThinkPHP, it will output: ASP.NET, can modify

and delete

When compiling nginx, you can add a module, HttpHeadersMore, to uniformly delete or modify the returned http headers.
• Key content In addition, the web server itself will also spit out its own version number. The http header is Server:xxxxx. This sometimes causes someone to specifically exploit the vulnerability of a specific version of the web server to attack. nginx can add or modify it in the configuration file

to remove the version number.