Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I did a security scan of my server and got the following message:

This test gives some information about the remote HTTP protocol 
- the version used, whether HTTP Keep-Alive and HTTP pipelining 
are enabled, etc.

Protocol version: HTTP/1.1 
SSL: no 
Pipelining: yes 
Keep-Alive: yes 
Options allowed: (Not implemented) 
Headers: 
Date: Mon, 07 Oct 2013 13:00:40 GMT 
Server: Apache 
Vary: Cookie,Accept-Encoding 
X-Pingback: http://mydomain.com/xmlrpc.php 
Location: http://mydomain.com/ 
X-Powered-By: PleskLin 
Content-Length: 0 
Keep-Alive: timeout=5, max=100 
Connection: Keep-Alive 
Content-Type: text/html, charset=UTF-8 

What is required here and what can I safely remove?

Edit: found answer for X-Powered-By here and modified the question to only ask one question, not two.

share|improve this question
    
You probably have to modify source of httpd for 'Apache' httpd.apache.org/docs/2.2/mod/core.html#servertokens and your Plesk as well. –  Jiri Xichtkniha Oct 7 '13 at 15:42
    
@JiriXichtkniha I just set that to Prod from OS. I'll re-scan and see what that removes. –  agrothe Oct 7 '13 at 15:51
1  
This really isn't worth the effort. –  Zoredache Oct 7 '13 at 16:10
    
@Zoredache I agree it's low priority, but if a hacker knows about an exploit in, lets say Plesk, it would be fairly trivial to inspect packets looking for a server with Plesk in the X-Powered-By attribute and concentrate attacks there. –  agrothe Oct 7 '13 at 16:20
    
You can always get rid of Plesk. It's not likely that you actually need it. –  Michael Hampton Oct 7 '13 at 16:24
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.