Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using Springsource ERS Apache in our environment, regarding to hardening part Even after using ServerSignature Off, still we are receiving the

Server:Apache in the header information.

How can this be avoided?

share|improve this question

You could install mod_security, a free add-on that will allow you to change the Server: header to what ever you wish, for example you could make it say "IIS" or just make it say "None of your business!" :)

share|improve this answer
Could you ever tried mod_security installation with Springsource ERS Apache , becoz we are facing lot errors while doing "make" ] – Sivaguru Nathan Apr 18 '11 at 13:47
No, I haven't. Instead of trying to compile it from source, why not see if there is a package available for your OS? – BenGC Apr 18 '11 at 14:58
I think for Solaris , there wont be any package for solaris .. if its available means pls share ... the link where to download – Sivaguru Nathan Apr 18 '11 at 15:21

The details as in the signature or headers are controlled by the ServerTokens directive. You cannot show less than "Apache" without modifying the source code and re-compiling Apache.

You shouldn't worry too much about this, there are other ways to get to know that you're using Apache: error pages (not just 404, but bad headers for example) or requesting .ht files (denied by default in Apache).

share|improve this answer
Hi Lekensteyn, we are using customized error pages to avoid such vulnerability and disabled .ht access in our environment, came to know using mod_security we can completely disable this info , but the compilation of mod_security with Springsource has not been succeufully completed.. – Sivaguru Nathan Apr 18 '11 at 13:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.