Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have been working on my web server for a good part of the day, and now I am getting done almost and for some reason no matter where I put :

  • ServerTokens Prod
  • ServerSignature Off

in the apache.conf or in the httpd.conf files

And to still no avail. I tried putting into sites-available and still nothing. Am I doing something wrong here?

my modules enabled go like so :

  1. Mod_Alias
  2. Mod_authz_host
  3. mod_deflate
  4. Mod_mime
  5. Mod_php5
  6. Mod_reqtimeout
  7. Mod_setenvif
  8. mod_ssl

Am I missing anything to this?


share|improve this question
Are you restarting apache after your configuration changes? – EEAA Jan 26 '13 at 23:08
I literally just found out why this was happening. You must go to /conf.d/security then you can find the two variables there. However all other "security hardening sites" / tutorials tell you to put it in httpd – RaGe10940 Jan 26 '13 at 23:09
Great! Please post that as an answer and then come back in a day or two to accept your own answer. – EEAA Jan 26 '13 at 23:12
New users only need to wait 8 hours before accepting their own answer. So not that long. – Michael Hampton Jan 27 '13 at 1:30

Sorry for the wait I had to wait to input the answer but here it is :

go to /etc/apache2/conf.d/security and there you will see the two variables. Spread the word as all the "how to sites" stated to put the ServerTokens and ServerSignature on apache2.conf and that didn't work. And for noobies (like me) this is very misleading.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.