ServerTokens Prod, ServerSignature Off

web

I tend to forget the syntax every time, but one of the first things I do when I setup an Apache web server is add/edit these two directive in my httpd.conf:

ServerSignature Off
ServerTokens Prod

The first one, ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates.

The second one ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.

Why do this?

I do this for security reasons. Its not a good idea to broadcast the versions of software your running. While it doesn't make your server any more secure, it may make you less of a target.

What if I am running IIS?

For IIS you can use Microsoft's Free URLScan tool, that latest version of this tool now supports IIS 7.


cfobjective pre-conf training

Related Entries

15 people found this page useful, what do you think?

WAF for CF

Trackbacks

Trackback Address: 419/D2A7903777E601A38B25BD466048A4C1

Post a Comment




  



Spell Checker by Foundeo

Recent Entries





Basecamp
pfreitag on twitter