Hide version information configuration methods for Apache and PHP

Hide Apache and PHP version information, Web server avoids some unnecessary trouble, can put Apache and PHP version information does not show

Hide Apache Version Information

/etc/apache2/apache2.conf or/etc/httpd/conf/httpd.conf

Servertokens productonly
Serversignature off

Restart Apache
Now the HTTP header sees only:
Server:apache

Hide PHP Version
Ini

expose_php on
Change into
expose_php off

After restarting Apache, the PHP version is hidden in the HTTP header.

Detailed

To prevent some ulterior motives from peering into our servers, we should do something about it.
Let's take a look at the related 2 parameters, Servertokens and serversignature, which should have some effect by controlling the 2 valves, as we can say in the configuration file:
Servertokens Prod
Serversignature off

Servertokens
Used to control whether the server is responding to requests from the client, and to output important system information such as Server system type or built-in module to the client. Provide global control in the master configuration The default threshold is "full", so if your Linux distribution has not changed this threshold, all sensitive information about your system will be servertokens to the world. For example, Rhel will change the threshold to "Servertokens OS", while Debian still uses the default "full" threshold
In the case of apache-2.0.55, the threshold can be set to one of the following (followed by the corresponding banner Header):
Prod >>> Server:apache
Major >>> SERVER:APACHE/2
Minor >>> server:apache/2.0
Minimal >>> server:apache/2.0.55
OS >>> server:apache/2.0.55 (Debian)
Full (or not specified) default >>> server:apache/2.0.55 (Debian) php/5.1.2-1+b1 mod_ssl/2.0.55 openssl/0.9.8b

Serversignature
Controls how information is displayed in the footer of a system-generated page (Error message, mod_proxy FTP directory listing, and so on).

Can be controlled in the global settings file, or through the. htaccess file Control
The default is "off", and some Linux distributions may open this valve, such as Debian on the default virtual host by default to set this valve to open serversignature
The valve value of the global valve is covered by the threshold in the configuration file of the virtual host or directory unit, so it must be ensured that such a thing should not happen.