Apache - Restricting "Server" information in HTTP response header with ServerTokens
Apache - how to strip down the "Server" field in HTTP response header with ServerTokens
By default, the apache webserver may provide too detailed info in the http response header for your needs. Example:
Code:
HTTP/1.1 404 Not Found
Date: Thu, 10 Nov 2011 10:35:52 GMT
Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8e
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 202
Connection: close
Content-Type: text/html; charset=iso-8859-1
Stripping down the "Server" field in the http response can be done in Apache with the "ServerTokens" directive:
Quote:
# ServerTokens
# This directive configures what you return as the Server HTTP response
# Header. The default is 'Full' which sends information about the OS-Type
# and compiled in modules.
# Set to one of: Full | OS | Minor | Minimal | Major | Prod
# where Full conveys the most information, and Prod the least.
I use the "Prod" value and this is the output:
Code:
HTTP/1.1 304 Not Modified
Date: Thu, 10 Nov 2011 10:38:52 GMT
Server: Apache
Connection: close
ETag: "fa50a-333-4b04c9edb0700"
Expires: Sat, 10 Dec 2011 10:38:52 GMT
Cache-Control: max-age=2592000
News 
Site map 
SitemapIndex 
RSS Feed 