How to Turn Off Server Signature for Better Security (2026)

Every web server can announce what software it runs. Apache, for example, may add its version and operating system to HTTP headers and error pages. That’s free information for attackers looking for unpatched servers. Just as we suggest you hide your WordPress version, you should turn off server signature details too. Here’s how on Apache, Nginx, LiteSpeed and PHP in 2026.

Quick answer: On Apache, add ServerSignature Off and ServerTokens Prod to the main server configuration and restart Apache. On Nginx, add server_tokens off; in the http block. In PHP, set expose_php = Off to remove the X-Powered-By header. Then check your HTTP headers to confirm the version numbers are gone.

What is a server signature?

The server signature is the software name and version your server shows in two places:

• The Server: HTTP response header, for example Apache/2.4.x (Ubuntu).
• The footer of default error pages such as 404 and 403.

Hiding it doesn’t fix vulnerabilities, but it stops automated scanners from instantly spotting old versions. Keeping software updated is still the real protection.

How to check your server signature

• Run curl -I https://yoursite.com in a terminal and look at the Server and X-Powered-By lines.
• Or open your browser’s DevTools, go to the Network tab, reload the page and click the first request to view its response headers.
• Visit a page that doesn’t exist and look at the bottom of the error page.

Turn off server signature on Apache

Add these lines to your main Apache configuration (for example apache2.conf, httpd.conf or security.conf), then restart Apache:

ServerSignature Off
ServerTokens Prod

ServerSignature Off removes the version line from error pages. ServerTokens Prod shortens the Server header to just “Apache”. ServerTokens can’t be set in .htaccess, so on shared hosting ask your host.

Our 2012 fix with cPanel/WHM

When we checked our own headers in 2012, they showed full server details. We asked our VPS host Knownhost, and support quickly set ServerSignature Off and ServerTokens ProductOnly. If you manage a cPanel server yourself, you’ll find both options in WHM > Service Configuration > Apache Configuration > Global Configuration.

Turn off server tokens on Nginx

Add this inside the http { } block of nginx.conf and reload Nginx:

server_tokens off;

The header will still say “nginx” but without the version number.

LiteSpeed and PHP

• LiteSpeed / OpenLiteSpeed: in the admin console, look for the server signature setting under Server Configuration > General and choose to hide the version.
• PHP: set expose_php = Off in php.ini (or your host’s PHP settings) to remove the X-Powered-By: PHP/8.x header.

Other quick hardening steps

• Keep the web server, PHP and WordPress updated.
• Remove the WordPress version from your source code; see how to hide your WordPress version.
• Turn off directory listing (Options -Indexes on Apache).
• Use a firewall or CDN in front of your site.

FAQ

Does hiding the server signature make my site secure?

No, it only hides information. It’s a small extra layer; updates and patches are what keep your server safe.

Can I turn off server signature in .htaccess?

ServerSignature Off works in .htaccess on many hosts, but ServerTokens must go in the main server configuration.

What does ServerTokens Prod do?

It makes Apache report only “Apache” in the Server header, without the version or operating system.