Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I did a security scan of my server and got the following message:

This test gives some information about the remote HTTP protocol 
- the version used, whether HTTP Keep-Alive and HTTP pipelining 
are enabled, etc.

Protocol version: HTTP/1.1 
SSL: no 
Pipelining: yes 
Keep-Alive: yes 
Options allowed: (Not implemented) 
Date: Mon, 07 Oct 2013 13:00:40 GMT 
Server: Apache 
Vary: Cookie,Accept-Encoding 
X-Powered-By: PleskLin 
Content-Length: 0 
Keep-Alive: timeout=5, max=100 
Connection: Keep-Alive 
Content-Type: text/html, charset=UTF-8 

What is required here and what can I safely remove?

Edit: found answer for X-Powered-By here and modified the question to only ask one question, not two.

share|improve this question
You probably have to modify source of httpd for 'Apache' and your Plesk as well. – Jiri Xichtkniha Oct 7 '13 at 15:42
@JiriXichtkniha I just set that to Prod from OS. I'll re-scan and see what that removes. – agrothe Oct 7 '13 at 15:51
This really isn't worth the effort. – Zoredache Oct 7 '13 at 16:10
@Zoredache I agree it's low priority, but if a hacker knows about an exploit in, lets say Plesk, it would be fairly trivial to inspect packets looking for a server with Plesk in the X-Powered-By attribute and concentrate attacks there. – agrothe Oct 7 '13 at 16:20
You can always get rid of Plesk. It's not likely that you actually need it. – Michael Hampton Oct 7 '13 at 16:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.