Go to app
Informational

Server

Advertises the web server software, and often its exact version, handing potential attackers a head start on known exploits.

What it does

The Server header identifies the software handling the request, for example nginx/1.24.0 or Apache/2.4.58. Most web servers send it by default without anyone deciding to.

Why it matters

This isn't a vulnerability on its own, but it is free reconnaissance. An attacker scanning for a target with a known, unpatched vulnerability in a specific server version can filter candidates instantly just by reading this header, rather than having to probe for it. Removing it doesn't make you secure: it just removes one of the easiest signals an automated scanner relies on.

Suppress or genericise it rather than setting it to something specific. How you do this depends on your server:

  • nginx: server_tokens off; removes the version number.
  • Apache: ServerTokens Prod and ServerSignature Off reduce it to just Apache.
  • CDN/reverse proxy: most let you strip or rewrite this header before it reaches the client.

Treat this as a low-priority hardening step rather than a critical fix: it reduces reconnaissance value but doesn't close an actual vulnerability by itself.