ServerTokens Prod, ServerSignature Off

July 25, 2005

I tend to forget the syntax every time, but one of the first things I do when I setup an Apache web server is add/edit these two directive in my httpd.conf:

ServerSignature Off
ServerTokens Prod

The first one, ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates.

The second one ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.

Why do this?

I do this for security reasons. Its not a good idea to broadcast the versions of software your running. While it doesn't make your server any more secure, it may make you less of a target.

What if I am running IIS?

For IIS you can use Microsoft's Free URLScan tool, that latest version of this tool now supports IIS 7.

Permalink | Add Comment |

add to del.icio.us | Tags: security, http, servers, apache

Related Entries

HTTP Request Smuggling (HRS) - June 10, 2005
Changing the ColdFusion CFIDE Scripts Location - January 10, 2011
HTTP Strict Transport Security - September 17, 2010
ColdFusion wsconfig Hotfix CVE-2009-1876 is for Apache Only - August 20, 2009
Firefox 3.5 Introduces Origin Header, Security Features - June 30, 2009

16 people found this page useful, what do you think?

Trackbacks

Trackback Address: 419/D2A7903777E601A38B25BD466048A4C1

Comments

On 03/28/2011 at 7:53:52 PM EDT Michael Kane wrote:

For Windows servers, is installing UrlScan the only way to address this issue?

On 10/15/2011 at 8:56:27 AM EDT S wrote:

Sadly, these no longer work. I added both into the httpd.conf on Debian Squeeze and OpenVAS reported: Apache Web Server version 2.2.16 was detected on the host.

Have to think of something else :(

On 12/21/2011 at 4:41:29 AM EST Marcus wrote: