By default, Nginx may expose webserver version information through the HTTP response headers. Depending on the configuration, this can also reveal information about the underlying operating system.<\/p>\n\n\n\n
Exposing detailed server information is generally not recommended because it provides attackers with additional information about the server environment and may help them identify potential vulnerabilities.<\/p>\n\n\n\n
In this article, we will explain how to hide the Nginx version and modify the Before proceeding, make sure you have:<\/p>\n\n\n\n If Nginx is not installed, refer to the appropriate installation guide:<\/p>\n\n\n\n Note:<\/strong> The configuration described in this article was tested on Ubuntu. The On Ubuntu, install The Before making any changes, check whether Nginx is exposing its version information.<\/p>\n\n\n\n Run:<\/p>\n\n\n\n You may see output similar to:<\/p>\n\n\n\n The Open the Nginx configuration file:<\/p>\n\n\n\n Under the The The For example:<\/p>\n\n\n\n Before restarting Nginx, check the configuration for syntax errors:<\/p>\n\n\n\n A successful configuration test should return:<\/p>\n\n\n\n Restart the Nginx service:<\/p>\n\n\n\n Alternatively, on systems using systemd:<\/p>\n\n\n\n Run the same The response should now contain a custom The Nginx version and operating system information are no longer exposed in the response header.<\/p>\n\n\n\n By default, Nginx can expose server version information through HTTP response headers. Disabling Although hiding server information is not a complete security solution, reducing unnecessary information disclosure is a useful security hardening practice.<\/p>\n\n\n\n Exposing the Nginx version provides unnecessary information about the server and may help attackers identify vulnerabilities associated with a particular version.<\/p>\n\n\n\n The No. It normally hides the version information but does not remove the Install Nginx on cPanel Using Engintron (Step-by-Step Guide)<\/a><\/p>\n\n\n\nServer<\/code> response header.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
\n
\n
more_set_headers<\/code> directive requires the Nginx headers-more module, which may need to be installed separately depending on your Nginx package.<\/p>\n<\/blockquote>\n\n\n\nImplementation<\/h2>\n\n\n\n
Step 1: Install the Required Nginx Package<\/h3>\n\n\n\n
nginx-extras<\/code>:<\/p>\n\n\n\napt-get -y install nginx-extras<\/pre>\n\n\n\n
nginx-extras<\/code> package provides additional Nginx modules, including the functionality required for the more_set_headers<\/code> directive.<\/p>\n\n\n\nStep 2: Check the Current Server Information<\/h3>\n\n\n\n
curl -I http:\/\/IPaddress<\/pre>\n\n\n\n
HTTP\/1.1 301 Moved Permanently
Server: nginx\/1.10.0 (Ubuntu)<\/pre>\n\n\n\nServer<\/code> header reveals both the Nginx version and operating system information.<\/p>\n\n\n\nStep 3: Modify the Nginx Configuration<\/h3>\n\n\n\n
vi \/etc\/nginx\/nginx.conf<\/pre>\n\n\n\n
http<\/code> section, add or modify the following configuration:<\/p>\n\n\n\nserver_tokens off;
more_set_headers 'Server: PheonixSolutions';<\/pre>\n\n\n\nserver_tokens off;<\/code> directive prevents Nginx from including its version number in the Server<\/code> header.<\/p>\n\n\n\nmore_set_headers<\/code> directive allows you to replace the default Server<\/code> header with a custom value.<\/p>\n\n\n\nhttp {
server_tokens off;
more_set_headers 'Server: PheonixSolutions';
...
}<\/pre>\n\n\n\nStep 4: Test the Nginx Configuration<\/h3>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
syntax is ok
test is successful<\/pre>\n\n\n\nStep 5: Restart Nginx<\/h3>\n\n\n\n
service nginx restart<\/pre>\n\n\n\n
systemctl restart nginx<\/pre>\n\n\n\n
Step 6: Verify the Server Header<\/h3>\n\n\n\n
curl<\/code> command again:<\/p>\n\n\n\ncurl -I http:\/\/IPaddress<\/pre>\n\n\n\n
Server<\/code> header similar to:<\/p>\n\n\n\nHTTP\/1.1 301 Moved Permanently
Server: PheonixSolutions<\/pre>\n\n\n\nConclusion<\/h2>\n\n\n\n
server_tokens<\/code> helps prevent Nginx from revealing its version, while the headers-more<\/code> module can be used to customize the Server<\/code> header.<\/p>\n\n\n\nFAQs<\/h2>\n\n\n\n
1. Why should I hide the Nginx version?<\/h3>\n\n\n\n
2. What does
server_tokens off<\/code> do?<\/h3>\n\n\n\nserver_tokens off;<\/code> directive prevents Nginx from displaying its version number in the Server<\/code> response header.<\/p>\n\n\n\n3. Does
server_tokens off<\/code> completely remove the Server header?<\/h3>\n\n\n\nServer<\/code> header itself.<\/p>\n\n\n\nRelated Article<\/h2>\n\n\n\n