Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out.

Would this prevent hackers from determining which webserver I'm using, and therefore make it more difficult to locate an exploitable crack in my security?

share|improve this question
+1 for using the word obfuscating. – joeqwerty Sep 8 '11 at 0:31
can i say: "security through obscurity...." – sybreon Sep 8 '11 at 7:58
lol thanks joeqwerty! – Ericson578 Sep 9 '11 at 16:22
up vote 4 down vote accepted

It'll fool some bots, but a human attacker isn't going to care that you're not advertising your server's minor version in headers. There is value in bot dodging, but it's pretty limited.

If you're looking to do this, make sure you aren't presenting full version information on error pages, either (the ServerSignature directive, for example, in Apache).

share|improve this answer
Thanks, it doesn't seem like it'll cause any harm so I think I'll implement what you're suggestion and ensure the error pages are server info free. – Ericson578 Sep 7 '11 at 20:59

No. They'll just either figure out the server using other quirky behavior or they'll try all exploits for all servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.