{"id":8674,"date":"2020-06-11T08:42:51","date_gmt":"2020-06-11T12:42:51","guid":{"rendered":"http:\/\/local.brightwhiz\/?p=8674"},"modified":"2021-12-04T09:16:10","modified_gmt":"2021-12-04T09:16:10","slug":"hide-apache-php-version-from-http-headers","status":"publish","type":"post","link":"http:\/\/local.brightwhiz\/hide-apache-php-version-from-http-headers\/","title":{"rendered":"How to Hide Apache and PHP Version From HTTP Headers"},"content":{"rendered":"\n
This is why you may want to hide Apache web server and PHP<\/a> versions used on your server in times when cybersecurity is a major cause for concern.<\/p>\n\n\n\n The reason why you may want to do this is that potential hackers can use that information to exploit known security<\/a> holes in vulnerable releases.<\/p>\n\n\n\n It is therefore advisable as a step to harden your server and expose as little as possible about your server to the general public.<\/p>\n\n\n\n You can use the command below to view what information your server is sending to end-users in the HTTP<\/a> headers.<\/p>\n\n\n\n part of your response will contain the headers similar to this:<\/p>\n\n\n\n Now that you have gotten a view of the current headers sent, you are ready to begin hiding the Apache\/PHP headers<\/p>\n\n\n\n Open the Apache<\/a> configuration file on your system. The Apache configuration file can be found at the following location:<\/p>\n\n\n\n CentOS\/Fedora\/Redhat based distros<\/p>\n\n\n\n On Ubuntu\/Debian based distros<\/p>\n\n\n\n We are then going to set up the ServerTokens directive. This directive controls whether the response header which is sent back to clients includes the generic OS details.<\/p>\n\n\n\n Here you can use one of the following options Full, Prod, Major, Minor, Min,<\/strong> or OS<\/strong> as specified in the official Apache documentation found here<\/a>.<\/p>\n\n\n\n in our example, we use Prod to display minimal information.<\/p>\n\n\n\n Next, we need to set up the ServerSignature directive. This one configures whether server information will be displayed in the footer on server-generated documents such as the 404 error<\/strong> page.<\/p>\n\n\n\n To set this directive uses the same Apache configuration file and search ServerSignature directive and update it as shown below.<\/p>\n\n\n\n Save and close the file. You can find out more about the ServerSignature Directive here<\/a>.<\/p>\n\n\n\n$ wget --server-response --spider http:\/\/example.com\/<\/code><\/pre>\n\n\n\n
HTTP request sent, awaiting response...\n HTTP\/1.1 302 Found\n Date: Thu, 11 Jun 2020 09:52:58 GMT\n Server: Apache\/2.4.43 (Ubuntu)\n X-Powered-By: PHP\/7.4.0+ubuntu18.04.1+deb\n X-Frame-Options: DENY\n X-Content-Type-Options: nosniff\n Location: https:\/\/toshiba.main\/\n Keep-Alive: timeout=5, max=100\n Connection: Keep-Alive\n Content-Type: text\/html; charset=iso-8859-1<\/code><\/pre>\n\n\n\n
Step 1: Hide Apache Server Details<\/h2>\n\n\n\n
$ sudo nano \/etc\/httpd\/conf\/httpd.conf<\/code><\/pre>\n\n\n\n
$ sudo nano \/etc\/apache2\/conf-enabled\/security.conf<\/code><\/pre>\n\n\n\n
ServerTokens Directive<\/h2>\n\n\n\n
ServerTokens Prod # Result is Server: Apache<\/code><\/pre>\n\n\n\n
ServerSignature Directive<\/h2>\n\n\n\n
ServerSignature Off<\/code><\/pre>\n\n\n\n
Step 2: Hide the PHP Version<\/h2>\n\n\n\n