Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I make it appear as though I'm not running Apache? I figure the best way is to appear as though it is another type of httpd, like lighthttpd or iis. I know that by using mod_security you can change your server signature into anything:

SecServerSignature "Microsoft IIS"

Does anyone know of other tricks in obscuring the HTTPD being used?

share|improve this question
up vote 7 down vote accepted

Why would you attempt this?

There are so many obvious and non-obvious ways that apache httpd reveals itself. Spend your time on real security instead. Version identifiers, stock pages, HTTP headers and loaded modules are just some of the ways Apache httpd reveals itself.

Run apache with a few modules loaded as possible. Ship logs off to another host and do real-time log analysis.

Design your system so that a compromise of apache doesn't lead to direct access to whatever you're trying to protect.

share|improve this answer
Also, most automated attacks don't check server fingerprint at all, as evidenced by the many iis+asp based attack attempts I see in my Apache logs (and vice-versa). Hiding what your server runs makes no difference if the bot doesn't care an tries anyway. – David Spillett Jan 24 '10 at 1:06
+1 for WHY spend time on this psudeo-security. – Josh Brower Jan 24 '10 at 16:54
Who said I was defending against automated attacks? Giving any information to an attacker is a serious problem. I am a penetration tester and an exploit writer. – Rook Jan 28 '10 at 18:16

There are 2 ways. The simplest is to add this to your apache config file :

ServerSignature Off
ServerTokens Prod

The other one is to change this file /src/include/httpd.h in the apache source. Change :

#define SERVER_BASEVENDOR “Apache Group”


define SERVER_BASEVENDOR: Microsoft

Then recomplie apache.

Others solutions may exits, try "Apache banner faking" on google.

share|improve this answer

One can tell that Apache is being run from the style and content of the stock error pages (404, 500, etc.). Specify your own.

share|improve this answer

As Holst stated, you should really question why you you are wanting to obscure your host. Obscurity is one mechanism for security, but should be assumed to be the weakest, and as such needs to be only one layer in a much more robust security architecture.

I would highly recommend reviewing the CIS Benchmark for Apache and implementing whatever can be used in your environment. Along with NIST, the Center for Internet Security benchmarks are often used as the basis for standard configurations. Which is great, since the Professional Feed from Nessus includes audit files for comparing against the CIS benchmarks. Moreover, this puts you on the road towards a standard configuration that can be easily audited and greatly lowers the risks associated with attempting to adequately manage a multitude of dissimilar systems.

Going back to the original question, the CIS Apache Benchmark v2.2 recommend the following settings for Information Leakage Protection

ServerTokens Prod
ServerSignature Off 
share|improve this answer
+1 for pointing to CIS Benchmark – Josh Brower Jan 24 '10 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.