{"id":8674,"date":"2020-06-11T08:42:51","date_gmt":"2020-06-11T12:42:51","guid":{"rendered":"http:\/\/local.brightwhiz\/?p=8674"},"modified":"2021-12-04T09:16:10","modified_gmt":"2021-12-04T09:16:10","slug":"hide-apache-php-version-from-http-headers","status":"publish","type":"post","link":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","title":{"rendered":"How to Hide Apache and PHP Version From HTTP Headers"},"content":{"rendered":"\n

This is why you may want to hide Apache web server and PHP<\/a> versions used on your server in times when cybersecurity is a major cause for concern.<\/p>\n\n\n\n

The reason why you may want to do this is that potential hackers can use that information to exploit known security<\/a> holes in vulnerable releases.<\/p>\n\n\n\n

It is therefore advisable as a step to harden your server and expose as little as possible about your server to the general public.<\/p>\n\n\n\n

You can use the command below to view what information your server is sending to end-users in the HTTP<\/a> headers.<\/p>\n\n\n\n

$ wget --server-response --spider http:\/\/example.com\/<\/code><\/pre>\n\n\n\n

part of your response will contain the headers similar to this:<\/p>\n\n\n\n

HTTP request sent, awaiting response...\n  HTTP\/1.1 302 Found\n  Date: Thu, 11 Jun 2020 09:52:58 GMT\n  Server: Apache\/2.4.43 (Ubuntu)\n  X-Powered-By: PHP\/7.4.0+ubuntu18.04.1+deb\n  X-Frame-Options: DENY\n  X-Content-Type-Options: nosniff\n  Location: https:\/\/toshiba.main\/\n  Keep-Alive: timeout=5, max=100\n  Connection: Keep-Alive\n  Content-Type: text\/html; charset=iso-8859-1<\/code><\/pre>\n\n\n\n

Now that you have gotten a view of the current headers sent, you are ready to begin hiding the Apache\/PHP headers<\/p>\n\n\n\n

Step 1: Hide Apache Server Details<\/h2>\n\n\n\n

Open the Apache<\/a> configuration file on your system. The Apache configuration file can be found at the following location:<\/p>\n\n\n\n

CentOS\/Fedora\/Redhat based distros<\/p>\n\n\n\n

$ sudo nano \/etc\/httpd\/conf\/httpd.conf<\/code><\/pre>\n\n\n\n

On Ubuntu\/Debian based distros<\/p>\n\n\n\n

$ sudo nano \/etc\/apache2\/conf-enabled\/security.conf<\/code><\/pre>\n\n\n\n

ServerTokens Directive<\/h2>\n\n\n\n

We are then going to set up the ServerTokens directive. This directive controls whether the response header which is sent back to clients includes the generic OS details.<\/p>\n\n\n\n

Here you can use one of the following options Full, Prod, Major, Minor, Min,<\/strong> or OS<\/strong> as specified in the official Apache documentation found here<\/a>.<\/p>\n\n\n\n

in our example, we use Prod to display minimal information.<\/p>\n\n\n\n

ServerTokens Prod   # Result is Server: Apache<\/code><\/pre>\n\n\n\n

ServerSignature Directive<\/h2>\n\n\n\n

Next, we need to set up the ServerSignature directive. This one configures whether server information will be displayed in the footer on server-generated documents such as the 404 error<\/strong> page.<\/p>\n\n\n\n

To set this directive uses the same Apache configuration file and search ServerSignature directive and update it as shown below.<\/p>\n\n\n\n

ServerSignature Off<\/code><\/pre>\n\n\n\n

Save and close the file. You can find out more about the ServerSignature Directive here<\/a>.<\/p>\n\n\n\n

Step 2: Hide the PHP Version<\/h2>\n\n\n\n

By default PHP installation exposes to the world that PHP<\/a> is installed on the server within the HTTP header e.g., X-Powered-By: PHP\/7.4.0<\/strong>.<\/p>\n\n\n\n

You can disable this behavior by editing the PHP configuration files used in your system. Open the relevant php.ini<\/strong> files below<\/p>\n\n\n\n

CentOS\/Fedora\/Redhat based distros<\/p>\n\n\n\n

$ sudo nano \/etc\/php.ini<\/code><\/pre>\n\n\n\n

On Ubuntu\/Debian based distros<\/p>\n\n\n\n

$ sudo nano \/etc\/php\/7.4\/apache2\/php.ini<\/code><\/pre>\n\n\n\n

Note the version number in the Ubuntu\/Debian distros. Search for the directive below and set it to Off.<\/p>\n\n\n\n

expose_php = Off<\/code><\/pre>\n\n\n\n

Finally: Restart Apache and Verify Settings<\/p>\n\n\n\n

CentOS\/Fedora\/Redhat based distros<\/p>\n\n\n\n

$ sudo sytemctl restart httpd<\/code><\/pre>\n\n\n\n

On Ubuntu\/Debian based distros<\/p>\n\n\n\n

$ sudo sytemctl restart apache2<\/code><\/pre>\n\n\n\n

Query the server again<\/p>\n\n\n\n

$ wget --server-response --spider http:\/\/example.com\/<\/code><\/pre>\n\n\n\n

In the server response, confirm that X-Powered-By<\/strong> is no longer displayed and the Server: Apache<\/strong> is what is displayed as the server without any other version information.<\/p>\n\n\n\n

Conclusion.<\/h2>\n\n\n\n

That is how to hide Apache and PHP versions from the world on your server. Be sure to repeat the same process if you are running multiple PHP versions on your server by changing the PHP version number in Step 2.<\/p>\n","protected":false},"excerpt":{"rendered":"

This is why you may want to hide Apache web server and PHP versions used on your server in times when cybersecurity is a major cause for concern. The reason…<\/p>\n","protected":false},"author":1,"featured_media":8675,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,23,9,16],"tags":[58,121,193,304,320,354,424,433,452,526,531,598,635,636,638,643],"yoast_head":"\nHow to Hide Apache and PHP Version From HTTP Headers<\/title>\n<meta name=\"description\" content=\"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Hide Apache and PHP Version From HTTP Headers\" \/>\n<meta property=\"og:description\" content=\"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern\" \/>\n<meta property=\"og:url\" content=\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\" \/>\n<meta property=\"og:site_name\" content=\"Brightwhiz.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/brightwhiz\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-11T12:42:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-12-04T09:16:10+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Michael Bright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@brightwhizmag\" \/>\n<meta name=\"twitter:site\" content=\"@brightwhizmag\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Michael Bright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\"},\"author\":{\"name\":\"Michael Bright\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32\"},\"headline\":\"How to Hide Apache and PHP Version From HTTP Headers\",\"datePublished\":\"2020-06-11T12:42:51+00:00\",\"dateModified\":\"2021-12-04T09:16:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\"},\"wordCount\":472,\"publisher\":{\"@id\":\"http:\/\/local.brightwhiz\/#organization\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg\",\"keywords\":[\"Apache\",\"CentOS\",\"DevOps\",\"HTTP\",\"Internet\",\"Linux\",\"Open Source\",\"Optimization\",\"PHP\",\"Security\",\"Server\",\"Ubuntu\",\"Web\",\"Web Applications\",\"Web Development\",\"Websites\"],\"articleSection\":[\"Articles\",\"Guides\",\"How To\",\"Technology\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\",\"url\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\",\"name\":\"How to Hide Apache and PHP Version From HTTP Headers\",\"isPartOf\":{\"@id\":\"http:\/\/local.brightwhiz\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg\",\"datePublished\":\"2020-06-11T12:42:51+00:00\",\"dateModified\":\"2021-12-04T09:16:10+00:00\",\"description\":\"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern\",\"breadcrumb\":{\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage\",\"url\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg\",\"contentUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Hide Apache and PHP Version\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/local.brightwhiz\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Hide Apache and PHP Version From HTTP Headers\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/local.brightwhiz\/#website\",\"url\":\"http:\/\/local.brightwhiz\/\",\"name\":\"Brightwhiz.com\",\"description\":\"Best Tech guides, Tutorials, and News\",\"publisher\":{\"@id\":\"http:\/\/local.brightwhiz\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/local.brightwhiz\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/local.brightwhiz\/#organization\",\"name\":\"Brightwhiz\",\"url\":\"http:\/\/local.brightwhiz\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/\",\"url\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png\",\"contentUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png\",\"width\":706,\"height\":135,\"caption\":\"Brightwhiz\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/brightwhiz\/\",\"https:\/\/twitter.com\/brightwhizmag\",\"https:\/\/instagram.com\/bright_whiz\/\",\"https:\/\/www.pinterest.com\/sobbayi\/\",\"https:\/\/www.youtube.com\/channel\/UC6sCdP_d_RiTIM7ErFT-PSQ\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32\",\"name\":\"Michael Bright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/image\/\",\"url\":\"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g\",\"contentUrl\":\"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g\",\"caption\":\"Michael Bright\"},\"sameAs\":[\"https:\/\/sobbayi.com\"],\"url\":\"http:\/\/local.brightwhiz\/author\/sobbayiadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Hide Apache and PHP Version From HTTP Headers","description":"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","og_locale":"en_US","og_type":"article","og_title":"How to Hide Apache and PHP Version From HTTP Headers","og_description":"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern","og_url":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","og_site_name":"Brightwhiz.com","article_publisher":"https:\/\/www.facebook.com\/brightwhiz\/","article_published_time":"2020-06-11T12:42:51+00:00","article_modified_time":"2021-12-04T09:16:10+00:00","og_image":[{"width":1200,"height":630,"url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg","type":"image\/jpeg"}],"author":"Michael Bright","twitter_card":"summary_large_image","twitter_creator":"@brightwhizmag","twitter_site":"@brightwhizmag","twitter_misc":{"Written by":"Michael Bright","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#article","isPartOf":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/"},"author":{"name":"Michael Bright","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32"},"headline":"How to Hide Apache and PHP Version From HTTP Headers","datePublished":"2020-06-11T12:42:51+00:00","dateModified":"2021-12-04T09:16:10+00:00","mainEntityOfPage":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/"},"wordCount":472,"publisher":{"@id":"http:\/\/local.brightwhiz\/#organization"},"image":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage"},"thumbnailUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg","keywords":["Apache","CentOS","DevOps","HTTP","Internet","Linux","Open Source","Optimization","PHP","Security","Server","Ubuntu","Web","Web Applications","Web Development","Websites"],"articleSection":["Articles","Guides","How To","Technology"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","url":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","name":"How to Hide Apache and PHP Version From HTTP Headers","isPartOf":{"@id":"http:\/\/local.brightwhiz\/#website"},"primaryImageOfPage":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage"},"image":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage"},"thumbnailUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg","datePublished":"2020-06-11T12:42:51+00:00","dateModified":"2021-12-04T09:16:10+00:00","description":"This is why you may want to hide Apache and PHP versions used on your server in times when cyber security is a major cause for concern","breadcrumb":{"@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#primaryimage","url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg","contentUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2020\/06\/hide-apache-php.jpg","width":1200,"height":630,"caption":"Hide Apache and PHP Version"},{"@type":"BreadcrumbList","@id":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/local.brightwhiz\/"},{"@type":"ListItem","position":2,"name":"How to Hide Apache and PHP Version From HTTP Headers"}]},{"@type":"WebSite","@id":"http:\/\/local.brightwhiz\/#website","url":"http:\/\/local.brightwhiz\/","name":"Brightwhiz.com","description":"Best Tech guides, Tutorials, and News","publisher":{"@id":"http:\/\/local.brightwhiz\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/local.brightwhiz\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"http:\/\/local.brightwhiz\/#organization","name":"Brightwhiz","url":"http:\/\/local.brightwhiz\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/","url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png","contentUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png","width":706,"height":135,"caption":"Brightwhiz"},"image":{"@id":"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/brightwhiz\/","https:\/\/twitter.com\/brightwhizmag","https:\/\/instagram.com\/bright_whiz\/","https:\/\/www.pinterest.com\/sobbayi\/","https:\/\/www.youtube.com\/channel\/UC6sCdP_d_RiTIM7ErFT-PSQ"]},{"@type":"Person","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32","name":"Michael Bright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/image\/","url":"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g","contentUrl":"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g","caption":"Michael Bright"},"sameAs":["https:\/\/sobbayi.com"],"url":"http:\/\/local.brightwhiz\/author\/sobbayiadmin\/"}]}},"_links":{"self":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts\/8674"}],"collection":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/comments?post=8674"}],"version-history":[{"count":0,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts\/8674\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/media\/8675"}],"wp:attachment":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/media?parent=8674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/categories?post=8674"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/tags?post=8674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}