webzod
account

Hide the server version number on Apache

headers.disclosure.server_version · effort: minutes

Why it matters

A version number in the Server header tells attackers exactly which known vulnerabilities to try, without any probing. Hiding it fixes nothing by itself, so keep the software updated as well.

The fix

  1. Set ServerTokens in the main server configuration, for example the file below, and restart Apache; the header then says only Apache. ServerTokens is not allowed in a virtual host or .htaccess (in .htaccess it causes a 500 error). ServerSignature may also go in a virtual host or .htaccess.
/etc/apache2/conf-available/security.conf 
ServerTokens Prod
ServerSignature Off

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.