We are using Springsource ERS Apache in our environment, regarding to hardening part Even after using ServerSignature Off, still we are receiving the
Server:Apache in the header information.
How can this be avoided?
You could install mod_security, a free add-on that will allow you to change the Server: header to what ever you wish, for example you could make it say "IIS" or just make it say "None of your business!" :)
The details as in the signature or headers are controlled by the ServerTokens
directive. You cannot show less than "Apache" without modifying the source code and re-compiling Apache.
You shouldn't worry too much about this, there are other ways to get to know that you're using Apache: error pages (not just 404, but bad headers for example) or requesting .ht
files (denied by default in Apache).