ServerTokens Prod, ServerSignature Off

July 25, 2005

I tend to forget the syntax every time, but one of the first things I do when I setup an Apache web server is add/edit these two directive in my httpd.conf:

ServerSignature Off
ServerTokens Prod

The first one, ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates.

The second one ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.

Why do this?

I do this for security reasons. Its not a good idea to broadcast the versions of software your running. While it doesn't make your server any more secure, it may make you less of a target.

What if I am running IIS?

On IIS the Server header does not give as much version detail as Apache, but it can let someone know what primary OS version you are running (eg Windows 2008, 2012, 2012 r2).

For IIS you can use Microsoft's Free URLScan tool, that latest version of this tool now supports IIS 7.

Another option for IIS 7-8.5 is the StripHeaders IIS module.

What if my server header says Apache-Coyote/1.1?

This means that the header is coming from Tomcat, you can edit the value of the server header by editing server.xml and adding or editing the server attribute of the <Connector> tags.

Related Entries

18 people found this page useful, what do you think?



For Windows servers, is installing UrlScan the only way to address this issue?
Sadly, these no longer work. I added both into the httpd.conf on Debian Squeeze and OpenVAS reported:
Apache Web Server version 2.2.16 was detected on the host.

Have to think of something else :(
On debian and ubuntu this should be inserted in: /conf.d/security
and Apache 2+
works fine thx!
any settings need to alter in urlscan config file after installation?
If you use XAMPP (v2.5.8) look for the file named <strong>httpd-default.conf</strong> under \etc\xampp\apache\conf\extra and then make the necessary changes.

I was not able to find this info in the net. Hope it helps someone
Hi Guys,

This is achievable via URLRewrite outbound rule as well for IIS 7.
@vaas, when using URLScan to control this, you would edit the RemoveServerHeader value in the UrlScan.ini file, changing it from the default 0 to 1. Once saved, this change takes effect immediately.

That said, it only affects the Server header, one of two that HackmyCF will detect on a typical IIS-based installation of CF. The other it sees (and will require you to resolve) is the X-Powered-By: ASP.NET header, and Pete shows how to clear that in another technote here,
For anyone who comes here looking for a fix for Windows Servers using IIS 7.x, 8.x, or 10, install the URL Rewrite IIS extension:

You'll want to use it to create a new outbound rule with the following configuration:

Precondition: <None>
Matching scope: Server Variable
Variable name: RESPONSE_Server
Variable value: Matches the Pattern
Using: Regular Expressions
Pattern: .*
Action type: Rewrite
Value: Whatever you want your server header to be.

Hope that helps.
IIS URL rewrite and Helicon ISAPI rewrite do not work well together. We had hundreds of app. pool errors in the windows event logs.

Post a Comment


Spell Checker by Foundeo

Recent Entries


did you hack my cf?