Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to unset the "Server" field in response headers. I do this using Header unset Server, and that works fine for requests handled by mod_perl. However, for requests to /static I use Apache to serve static files. For some reason, when these files are loaded directly in the browser, the Server field is not removed. How can I go about fixing this?

Relevent parts of my httpd.conf:

LoadModule headers_module modules/
Header unset Server

<VirtualHost *:80>

    <Location />
        SetHandler modperl
        PerlResponseHandler MyHandler

    Alias /static/ /home/site/static/

    <Location /static>
        SetHandler None
share|improve this question
up vote 0 down vote accepted

Turning the server token off in the header does not appear to be an option for static content. You can reduce then disclosure to apache using the ServerTokens option. You can minimize disclosure by adding the following lines to your configuration. Reload the configuration after making the change.

ServerSignature Off
ServerTokens Prod
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.