Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to remove Apache web server information from http requests. I have already implemented ServerTokens Prod and that has reduced the information to just :

Server: Apache

now, I want to remove this information from requests as well. How can I do this?

share|improve this question
up vote 1 down vote accepted

Server cannot be unset, sorry. See here.

If you're content with just changing the string, mod_security can do it (SecServerSignature), as could a proxy of some kind (perversely, even an Apache proxy) in front of your server.

Removing it completely can certainly be done.. but I'm not aware of out-of-the-box software off the top of my head.

share|improve this answer
yum install mod_security

edit file /etc/httpd/conf.d/mod_security.conf

<IfModule mod_security2.c>
    # This is the ModSecurity Core Rules Set.
    SecServerSignature " " ## add this
    # Basic configuration goes in here
    Include modsecurity.d/*.conf
    Include modsecurity.d/base_rules/*.conf

SecServerSignature " " will hide Server: apache into Server :


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.