I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out.

Would this prevent hackers from determining which webserver I'm using, and therefore make it more difficult to locate an exploitable crack in my security?

  • 1
    +1 for using the word obfuscating. – joeqwerty Sep 8 '11 at 0:31
  • can i say: "security through obscurity...." – sybreon Sep 8 '11 at 7:58

It'll fool some bots, but a human attacker isn't going to care that you're not advertising your server's minor version in headers. There is value in bot dodging, but it's pretty limited.

If you're looking to do this, make sure you aren't presenting full version information on error pages, either (the ServerSignature directive, for example, in Apache).

  • Thanks, it doesn't seem like it'll cause any harm so I think I'll implement what you're suggestion and ensure the error pages are server info free. – Ericson578 Sep 7 '11 at 20:59

No. They'll just either figure out the server using other quirky behavior or they'll try all exploits for all servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.