webzod
account

Hide the server version number on nginx

headers.disclosure.server_version · effort: minutes

Why it matters

A version number in the Server header tells attackers exactly which known vulnerabilities to try, without any probing. Hiding it fixes nothing by itself, so keep the software updated as well.

The fix

  1. Add server_tokens off; to the http block, run sudo nginx -t and reload. The header then says only nginx.
  2. If nginx proxies to an application that sends its own Server header, nginx already replaces it with its own by default; check the application is not reached directly.
/etc/nginx/nginx.conf 
http {
    server_tokens off;
    # ...
}

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.