webzod
account

Hide the server version number

headers.disclosure.server_version · effort: minutes

Why it matters

A version number in the Server header tells attackers exactly which known vulnerabilities to try, without any probing. Hiding it fixes nothing by itself, so keep the software updated as well.

The fix

  1. Turn off version tokens in the web server: nginx server_tokens off; Apache ServerTokens Prod; IIS 10 removeServerHeader="true" on requestFiltering in web.config.
  2. If a proxy passes on an application server's Server header (Gunicorn, Kestrel, Jetty), hide it at the proxy or turn it off in that server's settings.
  3. Check that the server software is on a supported, patched version.
bash 
curl -sI https://example.com/ | grep -i '^server:'

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.