MSPs
Why Hide Your Web Server Version Banner? Security Explained
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
Your web server broadcasts its software name and version to anyone who asks. That hands attackers a map to known vulnerabilities tied to your exact stack. Attackers examine error pages or response headers to determine exact versions, cross-reference them with CVE databases, and exploit known vulnerabilities (amanchopra-atg.medium.com), often within hours of discovering an exposed system.
What version banners look like
Every HTTP response your server sends can include headers that identify it. The Server header might read "Apache/2.4.49" or "nginx/1.15.8". The X-Powered-By header commonly shows values like "PHP", "Express", "ASP.NET", "Next.js", or "Servlet", and some platforms include version numbers alongside the framework name (http.dev).
These headers appear in every response, not just error pages. The header is returned with each page and is not displayed in a user's browser, but this information can be viewed using a number of tools (github.com) like curl, browser developer tools, or any network scanner. An attacker uses the same methods, but at scale.
Why attackers want this information
An attacker seeing a specific version number like "nginx/1.15.8" knows immediately which exploits to try, while without version information they would need to probe multiple vulnerabilities blindly, wasting time and increasing detection risk. The National Vulnerability Database assigns unique identifiers to every disclosed security flaw. When exploits are cataloged by software name and version, your Server header becomes the search term that brings back a list of attacks that work against your stack.
This is not theoretical. A web server advertising itself as running a vulnerable version of Apache, such as "Apache/2.4.49", could be more likely to come under attack than a server that reveals only "Apache" (news.netcraft.com). The version number is the difference between reconnaissance and a targeted strike.
How do you turn off banners on Apache?
Open your Apache configuration file (commonly httpd.conf or apache2.conf, location varies by distribution). Add these two lines:
ServerTokens Prod ServerSignature Off
To strip version information from the response header, add ServerTokens Prod and ServerSignature Off to the Apache configuration file (sentrium.co.uk). Restart Apache. The Server header will now read "Apache" with no version number. To remove it entirely, you need mod_headers enabled and can add Header always unset Server.
How do you turn off banners on Nginx?
In your nginx.conf file, set server_tokens off in the http block to hide the specific version from the Server header and error pages, changing the header to just "Server: nginx". That hides the version but not the product name.
To remove the Server header completely, the most reliable method involves installing the headers-more module and using more_clear_headers 'Server'. The headers-more module is not included in the default nginx package on most distributions, so you may need to install nginx-extras or compile it separately. Test this in a staging environment first, some monitoring tools expect that header.
IIS
Starting with IIS 10, it is possible to remove the Server header completely using IIS Manager by opening Configuration Editor, navigating to system.webServer > security > requestFiltering, and changing removeServerHeader to True. For older IIS versions, you need the URL Rewrite extension or a custom HTTP module.
In production environments it is common practice and recommended by many security guidelines to remove the X-Powered-By header so attackers cannot easily determine your site is running ASP.NET. You can use IIS Manager to select your web application, open HTTP Response Headers, and remove the X-Powered-By header, or add a customHeaders section in web.config.
PHP
In php.ini set expose_php = Off to prevent PHP from sending X-Powered-By: PHP/version, which defaults to on. This is a php.ini-only setting, you cannot change it at runtime with ini_set(). Restart PHP-FPM or your web server after the change.
On shared hosting where you cannot edit php.ini, you can influence PHP settings through .user.ini in your document root, though not all hosts support this. If neither option works, you can remove the header programmatically using header_remove('X-Powered-By') in a script that runs on every request, but that adds overhead.
What this does not solve
Hiding version banners is one layer of the guide (/guide) to hardening web infrastructure, not a complete defense. An attacker can still fingerprint your stack by testing how it responds to malformed requests, examining default file paths, or checking TLS cipher ordering. CIS Benchmarks for your operating system and web server include banner suppression as one item in a checklist of 100+ hardening steps. If you are managing this for multiple clients, ActiScore's pricing (/pricing) includes automated security audits that surface missing headers like HSTS and CSP alongside the presence of version disclosure, scored on the same rubric across every site you monitor.
Removing the banner does not exempt you from patching. A server running a vulnerable version is vulnerable whether the banner admits it or not. The difference is an attacker has to work harder to confirm it, and automated scanners looking for easy targets move on. That margin matters when you are responsible for dozens or hundreds of client environments. Check your current exposure with the free AI-visibility check (/check), which includes header analysis in the security category.
Common questions
What is a web server version banner?
A web server version banner is information sent in HTTP response headers that identifies your server software and its exact version number. The Server header might read something like Apache/2.4.49 or nginx/1.15.8, while the X-Powered-By header often shows PHP, Express, ASP.NET, Next.js, or Servlet with version numbers. These headers appear in every HTTP response your server sends, not just error pages, and can be viewed using curl, browser developer tools, or network scanners even though they are not displayed in a user's browser.
Why do attackers care about my server version number?
Attackers use your exact version number to look up known vulnerabilities in databases like the National Vulnerability Database, which catalogs security flaws by software name and version. When an attacker sees nginx/1.15.8 in your headers, they know immediately which exploits to try instead of probing blindly through multiple vulnerabilities, which saves them time and reduces their detection risk. A web server advertising a vulnerable Apache version like 2.4.49 is more likely to face targeted attacks than one revealing only Apache without a version number, turning reconnaissance into a precise strike.
How do I remove the version banner from Apache?
Open your Apache configuration file, which is commonly httpd.conf or apache2.conf depending on your distribution, and add two lines: ServerTokens Prod and ServerSignature Off. After restarting Apache, the Server header will show only Apache with no version number. To remove the Server header entirely you need mod_headers enabled and can add Header always unset Server to your configuration. The ServerTokens Prod directive strips version information from the response header, while ServerSignature Off prevents version details from appearing in error pages and directory listings.
How do I hide the nginx version number?
In your nginx.conf file, add server_tokens off inside the http block to change the Server header from nginx/1.x.x to just nginx, hiding the specific version from both headers and error pages. To remove the Server header completely, the most reliable method requires installing the headers-more module and using more_clear_headers Server in your configuration. The headers-more module is not included in the default nginx package on most distributions, so you may need to install nginx-extras or compile nginx separately with the module, and you should test this in staging first since some monitoring tools expect the Server header to be present.
Does hiding my server banner actually improve security?
Hiding version banners is one layer of web infrastructure hardening, not a complete defense on its own. Attackers can still fingerprint your stack by testing responses to malformed requests, examining default file paths, or analyzing TLS cipher ordering, and removing the banner does not exempt you from patching vulnerabilities. However, it forces attackers to work harder to confirm your exact version and causes automated scanners looking for easy targets to move on. CIS Benchmarks for web servers include banner suppression as one item among over a hundred hardening steps, and the margin it creates matters when you are responsible for managing security across dozens or hundreds of client environments.