How to hide Apache and PHP version information

How to hide Apache and PHP version information

^{Created: 2019-05-06 02:36:46 | Last modified: 2023-12-01 02:44:04}
^{Access: Read}^{| Views: 122}^{| Rating: N/A}^{| Tags: apache php}
How to hide Apache and PHP version information from the world. This can help tighten security.

When using Apache and PHP, the version information is included in the header in the HTTP request. With this info being provided it can provide hackers information of potentially outdated services on a server allowing them to compromise them. If you hide this information it can help secure your servers.

Apache

Edit the configuration file

#Centos/Redhat/Fedora
vim /etc/httpd/conf/httpd.conf

#Ubuntu/Debian
vim /etc/apache2/conf-enabled/security.conf

Change the ServerTokens and ServerSignature directives to Prod and Off. Comment out the old and restart Apache.

#ServerTokens Minimal
ServerTokens Prod

#ServerSignature On
ServerSignature Off

PHP

Edit the configuration file

#Centos/Redhat/Fedora
vim /etc/php.ini

#Ubuntu/Debian
vim /etc/php/VERSION/apache2/php.ini

Change the expose_php value inside the config file. Comment out the old and restart Apache.

#expose_php = On
expose_php = Off

Testing

To test the server, just run some telnet commands to confirm only basic server info is provided, type the following

curl -I localhost 80
HEAD / HTTP/1.0
<enter again>

HTTP/1.1 200 OK
Date: Mon, 06 May 2019 03:47:25 GMT
Server: Apache
Connection: close
Content-Type: text/html;charset=UTF-8

Connection closed by foreign host.

Example

Notes

Other Apache ServerToken Directives

ServerTokens Full (or not specified)
Server sends (e.g.): Server: Apache/2.4.2 (Unix) PHP/4.2.2 MyMod/1.2

ServerTokens Prod[uctOnly]
Server sends (e.g.): Server: Apache

ServerTokens Major
Server sends (e.g.): Server: Apache/2

ServerTokens Minor
Server sends (e.g.): Server: Apache/2.4

ServerTokens Min[imal]
Server sends (e.g.): Server: Apache/2.4.2

ServerTokens OS
Server sends (e.g.): Server: Apache/2.4.2 (Unix)