Skip to main content
protocols.pageprotocols.page

Server

ResponseActive

The Server header identifies the software handling the request. Common values: nginx/1.24.0, Apache/2.4.57, cloudflare, Microsoft-IIS/10.0. Security best practice is to suppress or obscure Server values – advertising the exact software version helps attackers target known CVEs. Many WAFs strip or replace this header.

Server: <product>[/<version>] [<comment>]

Description

Server describes the origin server software. It was historically used for browser compatibility detection and telemetry. Modern security guidance recommends minimizing the Server header: either suppress it entirely or return a generic value like 'server: cloudflare'. Version numbers in Server headers have directly contributed to targeted exploitation of known vulnerabilities. Nginx can be configured with server_tokens off; Apache with ServerTokens Prod.

Examples

Default (verbose)
http
Server: nginx/1.24.0 (Ubuntu)
Hardened (minimal)
http
Server: nginx
Disable in Nginx
shell
# nginx.conf:
server_tokens off;
# Result: Server: nginx (no version)

Related

X-Powered-By

Specification

RFC 9110 – Server specification →