Linux Ask a question: How to turn off server signing on Apache Web server

Source: Internet
Author: User
Tags arch linux

issue : Whenever the APACHE2 site server returns an error page (for example, 404 page cannot be found, 403 Forbidden page), it displays the site server signature (for example, Apache version number and operating system information) at the bottom of the page. At the same time, when the Apache2 Web server is serving PHP pages, it will also display PHP version information. How do I turn off these Web server signatures on the APACHE2 Web server?

Disclosing the signature of a Web server with server/php version information poses a security risk because you basically tell the attacker about a known vulnerability on your system. Therefore, as a part of server hardening, it is highly recommended that you disable all site server signatures.

Disable Apache Web server signature

Disabling the Apache Web server signature can be done by editing the Apache configuration file.

On Debian,ubunt or Linux mint:

    1. $ sudo vi /etc/apache2/apache2. conf

On Centos,fedora,rhel or Arch Linux:

    1. $ sudo vi /etc/httpd/conf/httpd. conf

Add the following two lines to the bottom of the Apache configuration file.

Serversignature OFF

Servertokens Prod

Then restart the Web server for the changes to take effect:

  1. $ sudo service apache2 restart (Debian, Ubuntu or Linux Mint) /c11>
  2. $ sudo service httpd restart (CentOS/RHEL 6)
  3. $ sudo systemctl restart httpd. Service (Fedora, CentOS/RHEL 7, Arch Linux)

The first line of ' Serversignature Off ' causes the Apache2 Web server to hide Apache version information on all error pages.

However, without the second line of ' Servertokens Prod ', the Apache server will still contain a detailed server tag in the HTTP response header, which will leak the Apache version number.

The second line of 'servertokens Prod' is to compress the server tags to a minimum in the HTTP response header.

Therefore, when two rows are placed at the same time, Apache will not leak version information in the page or in the HTTP response header.

Hide PHP Version

Another potential security threat is the PHP version information leak in the HTTP response header. By default, the Apache Web server contains PHP version information through the "x-powered-by" field in the HTTP response header. If you want to hide the PHP version in the HTTP header, open the php.ini file with a text editor and find the "expose_php = on" line and change it to "expose_php = Off".

On Debian,ubunt or Linux mint:

    1. $ sudo vi /etc/php5/apache2/php. INI

On Centos,fedora,rhel or Arch Linux:

    1. $ sudo vi /etc/php. INI

expose_php = Off

Finally, restart the Apache2 Web server to reload the updated PHP configuration file.

Now you will no longer see the HTTP response header with the "x-powered-by" field.

More wonderful Linux video tutorials at 51CTO Academy:

Linux Ask a question: How to turn off server signing on Apache Web server

Related Article

Cloud Intelligence Leading the Digital Future

Alibaba Cloud ACtivate Online Conference, Nov. 20th & 21st, 2019 (UTC+08)

Register Now >

Starter Package

SSD Cloud server and data transfer for only $2.50 a month

Get Started >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.