X-Powered-By is an HTTP response header that some servers and frameworks add to indicate which technology produced a response. For PHP sites it can show the PHP version, for example a value that names PHP followed by a version number. Other platforms and frameworks can set similar headers. It is informational, not a standard security control, and many servers can be configured to remove or change it.
Scanners and checkers often read this header because it is easy to collect, and attackers use it for reconnaissance. A visible version number tells an outsider which software you probably run, which can help them choose what to try.
The header is not a reliable indicator of whether a server is patched. It can be missing, deliberately altered or set by a different component than the one that handles the request. Linux distributions also backport security fixes into older version numbers, so a header that shows an older version may still describe a fixed build, and a newer-looking one does not by itself prove safety. Treat it as a hint, not evidence.
Hiding or removing the header reduces the information you give away, but it does not fix any vulnerability and should not replace patching. To know what you actually run, check the installed package version and the vendor advisory for your operating system, and verify which PHP build the web-serving process loads.