Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having trouble hiding my server header (nginx 1.2.1).

I've google'd it and it seems all I have to do is to set server_tokens off; in nginx.conf. But doing this only removed the version number, but it still shows nginx as the server.

I've seen there's a module called HttpHeadersMoreModule but I don't need all those fancy options. All I want is to hide the header.

How can I manually hide the header completely?

share|improve this question

migrated from security.stackexchange.com Oct 31 '13 at 14:47

This question came from our site for Information security professionals.

    
Hiding the header does not get rid of security problems. You would do much better to keep nginx up to date. –  Michael Hampton Oct 31 '13 at 16:44
    
Yeah I noticed it wasn't the latest release. I assumed it would be, I'll update it later. –  hustlerinc Oct 31 '13 at 17:24

1 Answer 1

up vote 3 down vote accepted

If you don't want to use the module to remove the header then you will have to modify the source to not send it. There's no option in nginx to not send the nginx server header. On a side note, removing the header probably won't prevent people from figuring out you use nginx as each server has certain behaviours that can be probed.

share|improve this answer
    
Yeah I guess I'll have to use the module. And I know about the fingerprinting software issue's. I've got a question about that here: security.stackexchange.com/questions/44734/… You're free to help if you know any solutions. :) –  hustlerinc Oct 31 '13 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.