{"id":26375,"date":"2012-05-18T12:24:33","date_gmt":"2012-05-18T06:54:33","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/?p=26375"},"modified":"2026-10-13T13:40:47","modified_gmt":"2026-10-13T08:10:47","slug":"turn-off-server-signature","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/","title":{"rendered":"How to Turn Off Server Signature for Better Security (2026)"},"content":{"rendered":"<p>Every web server can announce what software it runs. Apache, for example, may add its version and operating system to HTTP headers and error pages. That&#8217;s free information for attackers looking for unpatched servers. Just as we suggest you hide your WordPress version, you should <strong>turn off server signature<\/strong> details too. Here&#8217;s how on Apache, Nginx, LiteSpeed and PHP in 2026.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-64483\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature-1024x538.webp\" alt=\"Turn off server signature\" width=\"1024\" height=\"538\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature-1024x538.webp 1024w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature-300x158.webp 300w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature-150x79.webp 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature-768x403.webp 768w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/turn-off-server-signature.webp 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> On Apache, add <code>ServerSignature Off<\/code> and <code>ServerTokens Prod<\/code> to the main server configuration and restart Apache. On Nginx, add <code>server_tokens off;<\/code> in the http block. In PHP, set <code>expose_php = Off<\/code> to remove the X-Powered-By header. Then check your HTTP headers to confirm the version numbers are gone.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af00ad852d06\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af00ad852d06\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#What_is_a_server_signature\" >What is a server signature?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#How_to_check_your_server_signature\" >How to check your server signature<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Turn_off_server_signature_on_Apache\" >Turn off server signature on Apache<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Our_2012_fix_with_cPanelWHM\" >Our 2012 fix with cPanel\/WHM<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Turn_off_server_tokens_on_Nginx\" >Turn off server tokens on Nginx<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#LiteSpeed_and_PHP\" >LiteSpeed and PHP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Other_quick_hardening_steps\" >Other quick hardening steps<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Does_hiding_the_server_signature_make_my_site_secure\" >Does hiding the server signature make my site secure?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#Can_I_turn_off_server_signature_in_htaccess\" >Can I turn off server signature in .htaccess?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2012\/05\/turn-off-server-signature\/#What_does_ServerTokens_Prod_do\" >What does ServerTokens Prod do?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"What_is_a_server_signature\"><\/span>What is a server signature?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The server signature is the software name and version your server shows in two places:<\/p>\n<ul>\n<li>The <code>Server:<\/code> HTTP response header, for example <code>Apache\/2.4.x (Ubuntu)<\/code>.<\/li>\n<li>The footer of default error pages such as 404 and 403.<\/li>\n<\/ul>\n<p>Hiding it doesn&#8217;t fix vulnerabilities, but it stops automated scanners from instantly spotting old versions. Keeping software updated is still the real protection.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_check_your_server_signature\"><\/span>How to check your server signature<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Run <code>curl -I https:\/\/yoursite.com<\/code> in a terminal and look at the Server and X-Powered-By lines.<\/li>\n<li>Or open your browser&#8217;s DevTools, go to the Network tab, reload the page and click the first request to view its response headers.<\/li>\n<li>Visit a page that doesn&#8217;t exist and look at the bottom of the error page.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Turn_off_server_signature_on_Apache\"><\/span>Turn off server signature on Apache<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Add these lines to your main Apache configuration (for example <code>apache2.conf<\/code>, <code>httpd.conf<\/code> or <code>security.conf<\/code>), then restart Apache:<\/p>\n<pre><code>ServerSignature Off\nServerTokens Prod<\/code><\/pre>\n<p><code>ServerSignature Off<\/code> removes the version line from error pages. <code>ServerTokens Prod<\/code> shortens the Server header to just &#8220;Apache&#8221;. ServerTokens can&#8217;t be set in .htaccess, so on shared hosting ask your host.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Our_2012_fix_with_cPanelWHM\"><\/span>Our 2012 fix with cPanel\/WHM<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>When we checked our own headers in 2012, they showed full server details. We asked our <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/07\/knownhost-vps-hosting-review\/\">VPS host Knownhost<\/a>, and support quickly set ServerSignature Off and ServerTokens ProductOnly. If you manage a cPanel server yourself, you&#8217;ll find both options in WHM &gt; Service Configuration &gt; Apache Configuration &gt; Global Configuration.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Turn_off_server_tokens_on_Nginx\"><\/span>Turn off server tokens on Nginx<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Add this inside the <code>http { }<\/code> block of <code>nginx.conf<\/code> and reload Nginx:<\/p>\n<pre><code>server_tokens off;<\/code><\/pre>\n<p>The header will still say &#8220;nginx&#8221; but without the version number.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"LiteSpeed_and_PHP\"><\/span>LiteSpeed and PHP<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>LiteSpeed \/ OpenLiteSpeed:<\/strong> in the admin console, look for the server signature setting under Server Configuration &gt; General and choose to hide the version.<\/li>\n<li><strong>PHP:<\/strong> set <code>expose_php = Off<\/code> in php.ini (or your host&#8217;s PHP settings) to remove the <code>X-Powered-By: PHP\/8.x<\/code> header.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Other_quick_hardening_steps\"><\/span>Other quick hardening steps<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Keep the web server, PHP and WordPress updated.<\/li>\n<li>Remove the WordPress version from your source code; see how to <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2007\/01\/security-update-everyone-knows-your-wordpress-version\/\">hide your WordPress version<\/a>.<\/li>\n<li>Turn off directory listing (<code>Options -Indexes<\/code> on Apache).<\/li>\n<li>Use a firewall or CDN in front of your site.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Does_hiding_the_server_signature_make_my_site_secure\"><\/span>Does hiding the server signature make my site secure?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No, it only hides information. It&#8217;s a small extra layer; updates and patches are what keep your server safe.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Can_I_turn_off_server_signature_in_htaccess\"><\/span>Can I turn off server signature in .htaccess?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>ServerSignature Off works in .htaccess on many hosts, but ServerTokens must go in the main server configuration.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_does_ServerTokens_Prod_do\"><\/span>What does ServerTokens Prod do?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It makes Apache report only &#8220;Apache&#8221; in the Server header, without the version or operating system.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every web server can announce what software it runs. Apache, for example, may add its version and operating system to&#8230;<\/p>\n","protected":false},"author":4,"featured_media":64483,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[25,7,41],"tags":[],"class_list":["post-26375","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting","category-security","category-search-engine-optimization"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/26375","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=26375"}],"version-history":[{"count":3,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/26375\/revisions"}],"predecessor-version":[{"id":65440,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/26375\/revisions\/65440"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/64483"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=26375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=26375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=26375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}