Pete Freitag Pete Freitag

ServerTokens Prod, ServerSignature Off

Updated on December 05, 2023
By Pete Freitag

I tend to forget the syntax every time, but one of the first things I do when I setup an Apache web server is add/edit these two directive in my httpd.conf:

ServerSignature Off
ServerTokens Prod

The first one, ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates.

The second one ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.

Why do this?

I do this for security reasons. Its not a good idea to broadcast the versions of software your running. While it doesn't make your server any more secure, it may make you less of a target.

What if I am running IIS?

There are a few different ways to remove the IIS server header that I have outlined in a separate entry.

What if my server header says Apache-Coyote/1.1?

This means that the header is coming from Tomcat, you can edit the value of the server header by editing server.xml and adding or editing the server attribute of the <Connector> tags.

Remove Server Tokens on Nginx

If you are running nginx, you can add the following inside your http configuration block:

server_tokens off;

This will prevent nginx from outputting the version number, but it will still report nginx as the server name.

security http servers apache

ServerTokens Prod, ServerSignature Off was first published on July 25, 2005.

If you like reading about security, http, servers, or apache then you might also like:

Weekly Security Advisories Email

Advisory Week is a new weekly email containing security advisories published by major software vendors (Adobe, Apple, Microsoft, etc).


For Windows servers, is installing UrlScan the only way to address this issue?
by Michael Kane on 03/28/2011 at 5:53:52 PM UTC
Sadly, these no longer work. I added both into the httpd.conf on Debian Squeeze and OpenVAS reported:
Apache Web Server version 2.2.16 was detected on the host.

Have to think of something else :(
by S on 10/15/2011 at 6:56:27 AM UTC
Hi Guys,

This is achievable via URLRewrite outbound rule as well for IIS 7.
by Tanshul Kumar on 04/10/2013 at 10:41:37 PM UTC
@vaas, when using URLScan to control this, you would edit the RemoveServerHeader value in the UrlScan.ini file, changing it from the default 0 to 1. Once saved, this change takes effect immediately.

That said, it only affects the Server header, one of two that HackmyCF will detect on a typical IIS-based installation of CF. The other it sees (and will require you to resolve) is the X-Powered-By: ASP.NET header, and Pete shows how to clear that in another technote here,
by charlie arehart on 06/18/2013 at 12:54:26 AM UTC
IIS URL rewrite and Helicon ISAPI rewrite do not work well together. We had hundreds of app. pool errors in the windows event logs.
by J on 05/11/2016 at 7:31:30 PM UTC