How do I hide the core version to the outside world? I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7.
Curiously enough in my case, I got a version slightly newer (just one minor version ahead), but I'm concerned anyway, should I not?
I'm thinking of every situation where a security update cannot be performed right away.
I don't even know how can the version be guessed from outside.
I issued a tail -f on the access log while pressing the Detect CMS button on whatcms.org, but, mysteriously, I got no log entry from there. Perhaps they cache the previous results on the same site not to perform a fetch each time the button is pressed with the same domain string input?
If you want to hide the Drupal version then you can use the following module:
https://www.drupal.org/project/remove_http_headers