How do I stop the Server header from leaking my version?

Every HTTP response can carry a Server header that names the software handling the request, and by default nginx and Apache are happy to include the exact version too. A reply like Server: nginx/1.24.0 tells a scanner precisely which build you run. Trimming that detail is a small, low-risk hardening step, but it is only one layer of defence and never a substitute for patching.

Why this matters

The Server header is reconnaissance fuel. An automated scanner reads the product and version, maps it against public vulnerability databases, and moves on to the payloads that match. A server that answers with a bare product name forces that scanner to guess, which raises the cost of casual, opportunistic probing. It does not, however, make the underlying software safe. MDN notes that hiding detail in this header has debatable value because server software can be fingerprinted through other behaviours, and the Apache documentation is blunter still: disabling the Server header does nothing to make a server more secure, and treating it as security is a myth. The honest framing is that header trimming reduces noise and slows down the laziest attacks, while keeping the software patched is what actually removes the vulnerability. The concrete risk of a version leak is that a known CVE can be matched to your exact build without any guesswork, so a scanner can skip straight to an exploit that is known to apply.

How to fix it

The switch depends on your stack. In nginx, server_tokens off; stops the version from being emitted in the Server field and on error pages. In Apache, ServerTokens Prod reduces the header to the product name alone and ServerSignature Off removes the version footer from server-generated error pages. If you want the header gone entirely, mod_headers can unset it. On a managed edge you can delete it in code.

# nginx: hide the version in the Server header and error pages
server {
    server_tokens off;
}

# Apache: product name only, and no version footer on error pages
ServerTokens Prod
ServerSignature Off

# Apache: remove the header completely with mod_headers
Header unset Server

// Cloudflare Workers: delete the header from the response
const newResponse = new Response(response.body, response);
newResponse.headers.delete("Server");

How to verify the fix

Request the headers of a response and read the Server line. After the change you should see a bare Server: nginx or Server: Apache, or no Server header at all if you unset it. You can also inspect the same field under Response Headers in the DevTools Network panel for any request. If you run behind a CDN or reverse proxy, check the header at the edge as well, because the origin and the edge can set it independently and either one can reintroduce the version.

curl -sI https://example.com | findstr /I "server"

Related issues