Simply modify the basic header to make the server more secure

Today, we can see the Response header returned by the server with such information.

Server: nginx/1.4.0
X-Powered-By: PHP/5.5.1
Content-Encoding: gzip:

The first shows the webserver used by the server and the version number.
Article 2 shows the script language and version number.
Article 3 shows how to compress through gzip
Security Questions:
The first two versions will undoubtedly expose the server version information. If any BUG occurs in the release version, the server vulnerabilities will be exposed.

Disable Nginx version display
Nginx will display a highlighted version number prompt in the http header or when an error page appears.
To ensure security, you can disable this information.
The method is simple. You only need to add the server_tokens parameter to the http {} of nginx. conf.
For example:

Http {include mime. types; default_type application/octet-stream; server_tokens off; # disable client_header_timeout 3 m; client_body_timeout 3 m; send_timeout 3 m; #...} overload webserver

Nginx reload

Note: It is a heavy load, not a restart!
The test results using the curl tool are as follows:

HTTP/1.1 301 Moved PermanentlyServer: nginxDate: Fri, 11 Dec 2009 01:47:53 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveKeep-Alive: timeout=20Location: http://levi.cg.am/

Disable php X-Powered-By information
Modify the php. ini file and set

Expose_php = Off restart the php Service

Php-fpm restart

Disable gzip output
This is a question.

Php writes a cache with no refreshing output, but it is invalid when nginx sets gzip compression. How can I set php to disable gzip output on the current page?

I tried to set php. ini to disable it.

Ini_set ('zlib. output_compression ', 'off ');

I think it may be because my gzip output is set through nginx.

 

Of course, you cannot use nginx to disable gzip for the whole site. I only want to disable gzip for the current page, so I can only disable gzip compression through header output.

Header ('content-Encoding: none'. PHP_EOL );