Hi Rick, thank you for your informative posts. But there is one thing I don't agree. If you are using CMS, then you CANNOT completely remove signature because each CMS has its own file structure, and that is the real signature. For example, even you remove/replace meta tag, or "powered by Wordpress", but in the source of a web page, if you see "wp-content" in the url, then you know it is using Wordpress.

Sophisticated hackers don't really rely on what CMS you use, their exploit scripts will just try to exploit if your site has vulnerabilities, that is how Fortify works. Fortify does not check if you are using WP, Drupal, Joomla, or whatever, it only checks to see if your site has security vulnerabilities.