How to Hide Web Server Information on Apache
Introduction
By default, Apache reveals details like its version number and operating system in HTTP response headers and error pages. This might seem harmless, but it actually gives attackers a head start knowing your exact Apache version and OS makes it far easier to find and exploit known vulnerabilities. That’s why learning how to hide web server information on Apache is one of the simplest and most effective steps you can take to harden your server.
In an earlier post, we covered how to hide web server information on Nginx. This time, we’ll walk through the same concept for Apache a quick two-line configuration change that stops your server from broadcasting more than it needs to.
If you don’t have Apache installed yet, start with our guide on installing Apache 2.4 and PHP on Ubuntu 16.04 before continuing.
Why Hide Apache Server Information?
Alt text for reference image: “hide web server information on Apache banner”
When Apache exposes its version and OS in the Server header or on default error pages (like a 404), it hands potential attackers useful reconnaissance data for free. Security best practices including guidelines from OWASP recommend suppressing this information as a basic hardening step, alongside things like disabling directory listing and keeping software patched.
This guide focuses on Ubuntu, but the same steps apply to Red Hat–based distributions with only minor path differences.
Steps to Hide Web Server Information on Apache
Step 1: Open the Security Configuration File
Apache’s security-related directives usually live in a dedicated config file. Open it with your preferred editor:
vi /etc/apache2/conf.d/security.conf
Note: on some Ubuntu/Debian installs this file may instead be located at
/etc/apache2/conf-available/security.conf. If the file doesn’t exist at the path above, check that location instead.
Step 2: Set ServerTokens and ServerSignature
Add or update the following two directives:
ServerTokens Prod ServerSignature Off
Here’s what each one does:
ServerTokens Prod— Limits theServerHTTP response header to just “Apache,” hiding the version number, OS, and compiled-in modules.ServerSignature Off— Removes the Apache version and server name footer that normally appears on error pages (like 404 and 403 pages).
Step 3: Verify the Configuration Syntax
Before restarting Apache, always check the config for syntax errors:
apachectl -t
You should see Syntax OK if everything is correctly formatted.
Step 4: Restart Apache
Apply the changes by restarting the service:
systemctl restart apache2
Verifying the Change
Once Apache restarts, confirm the fix worked by checking the response headers:
curl -I http://your-server-address
The Server header should now simply read Apache, with no version number or OS details attached.
Frequently Asked Questions
Does this work on Red Hat or CentOS too? Yes. The ServerTokens and ServerSignature directives work the same way. Only the config file path differs — typically /etc/httpd/conf/httpd.conf on Red Hat–based systems.
Will this break anything on my site? No. These directives only affect what information Apache reports about itself; they don’t change how your site or application behaves.
Is hiding server information enough to secure Apache? No — it’s one layer of defense, not a complete security strategy. Pair it with regular patching, disabling unnecessary modules, and following broader hardening guidelines.
Conclusion
Hiding Apache’s version and OS details is a small change with a real security payoff. With just two directives — ServerTokens Prod and ServerSignature Off — plus a config check and a restart, you reduce the information available to anyone probing your server for weaknesses. It only takes a few minutes, and it’s a step worth including in every Apache deployment checklist.
