How to Hide Webserver Information and Modify the Server Header on Nginx

Introduction

By default, Nginx may expose webserver version information through the HTTP response headers. Depending on the configuration, this can also reveal information about the underlying operating system.

Exposing detailed server information is generally not recommended because it provides attackers with additional information about the server environment and may help them identify potential vulnerabilities.

In this article, we will explain how to hide the Nginx version and modify the Server response header.

Prerequisites

Before proceeding, make sure you have:

1. An Ubuntu or CentOS server.
2. Root or sudo access to the server.
3. Nginx installed and configured.
4. Basic knowledge of Nginx configuration.

If Nginx is not installed, refer to the appropriate installation guide:

• Install Nginx on Ubuntu
• Install Nginx, PHP-FPM and MariaDB on CentOS 7

Note: The configuration described in this article was tested on Ubuntu. The more_set_headers directive requires the Nginx headers-more module, which may need to be installed separately depending on your Nginx package.

Implementation

Step 1: Install the Required Nginx Package

On Ubuntu, install nginx-extras:

apt-get -y install nginx-extras

The nginx-extras package provides additional Nginx modules, including the functionality required for the more_set_headers directive.

Step 2: Check the Current Server Information

Before making any changes, check whether Nginx is exposing its version information.

Run:

curl -I http://IPaddress

You may see output similar to:

HTTP/1.1 301 Moved Permanently
Server: nginx/1.10.0 (Ubuntu)

The Server header reveals both the Nginx version and operating system information.

Step 3: Modify the Nginx Configuration

Open the Nginx configuration file:

vi /etc/nginx/nginx.conf

Under the http section, add or modify the following configuration:

server_tokens off;
more_set_headers 'Server: PheonixSolutions';

The server_tokens off; directive prevents Nginx from including its version number in the Server header.

The more_set_headers directive allows you to replace the default Server header with a custom value.

For example:

http {
    server_tokens off;
    more_set_headers 'Server: PheonixSolutions';

    ...
}

Step 4: Test the Nginx Configuration

Before restarting Nginx, check the configuration for syntax errors:

nginx -t

A successful configuration test should return:

syntax is ok
test is successful

Step 5: Restart Nginx

Restart the Nginx service:

service nginx restart

Alternatively, on systems using systemd:

systemctl restart nginx

Step 6: Verify the Server Header

Run the same curl command again:

curl -I http://IPaddress

The response should now contain a custom Server header similar to:

HTTP/1.1 301 Moved Permanently
Server: PheonixSolutions

The Nginx version and operating system information are no longer exposed in the response header.

Conclusion

By default, Nginx can expose server version information through HTTP response headers. Disabling server_tokens helps prevent Nginx from revealing its version, while the headers-more module can be used to customize the Server header.

Although hiding server information is not a complete security solution, reducing unnecessary information disclosure is a useful security hardening practice.

FAQs

1. Why should I hide the Nginx version?

Exposing the Nginx version provides unnecessary information about the server and may help attackers identify vulnerabilities associated with a particular version.

2. What does server_tokens off do?

The server_tokens off; directive prevents Nginx from displaying its version number in the Server response header.

3. Does server_tokens off completely remove the Server header?

No. It normally hides the version information but does not remove the Server header itself.

Related Article

Install Nginx on cPanel Using Engintron (Step-by-Step Guide)

How to install and configure PHP with Nginx on centos7 – Pheonix Solutions

Talk to our experts

Have a technology challenge or looking for the right solution for your business? Our team can help you with cloud, DevOps, development, infrastructure, design, and more. Feel free to reach out to our experts here.