up vote 4 down vote favorite
share [g+] share [fb]

I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out.

Would this prevent hackers from determining which webserver I'm using, and therefore make it more difficult to locate an exploitable crack in my security?

link|improve this question
+1 for using the word obfuscating. – joeqwerty Sep 8 '11 at 0:31
can i say: "security through obscurity...." – sybreon Sep 8 '11 at 7:58
lol thanks joeqwerty! – Ericson578 Sep 9 '11 at 16:22
feedback

2 Answers

up vote 4 down vote accepted

It'll fool some bots, but a human attacker isn't going to care that you're not advertising your server's minor version in headers. There is value in bot dodging, but it's pretty limited.

If you're looking to do this, make sure you aren't presenting full version information on error pages, either (the ServerSignature directive, for example, in Apache).

link|improve this answer
Thanks, it doesn't seem like it'll cause any harm so I think I'll implement what you're suggestion and ensure the error pages are server info free. – Ericson578 Sep 7 '11 at 20:59
feedback
up vote 4 down vote

No. They'll just either figure out the server using other quirky behavior or they'll try all exploits for all servers.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.