Apache Tips:Hide Apache Information & PHP software version

By default, Apache will send version and modules information (e.g., mod_php, mod_perl, mod_ssl) in every HTTP header.

If you want to view Apache web server version and sofware of a remove server you follow this procedure

telnet www.example.com 80
Trying www.example.com.com…
Connected to www.example.com.
Escape character is ‘^]’.
HEAD / HTTP/1.0 <- after this press 2 times ENTER HTTP/1.1 200 OK Date: Fri, 09 Jan 2007 18:18:26 GMT Server: Apache/2.0.55 (Debian) PHP/5.1.2-1+b1 mod_ssl/2.0.55 OpenSSL/0.9.8b Connection: close Content-Type: text/html; charset=UTF-8 Connection closed by foreign host. In the above example it is showing all the details about your web server and php this is not recommended for security reasons.We need to hide this information with the following procedure. Hide Apache Information

To hide the information, add the following two apache directives in Apache configuration file /etc/apache2/apache2.conf

ServerTokens ProductOnly

ServerSignature Off

Now you need to restart your web server using the following command

#/etc/init.d/apache2 restart

Now the output for apache header looks like below

Server: Apache

Hide PHP Version Details

If you want to hide the PHP version you need to edit the /etc/php4/apache/php.ini(For php4 users) file and /etc/php5/apache/php.ini (For php5 users)

Change the following option

expose_php On


expose_php Off

Now you need to restart your web server using the following command

#/etc/init.d/apache2 restart

After making this change PHP will no longer add it’s signature to the web server header.

If you are running php from cli against a php file, the output is a html file (as seen by a browser). In some distributions (like Debian) the php-cli is controlled by a different php.ini file (/etc/php[4,5]/cli/php.ini).

Sponsored Link

8 thoughts on “Apache Tips:Hide Apache Information & PHP software version

  1. Thanks. After doing the above setup, the version details are not shown. But is there any way to hide (or change) the server name (Server: Apache). I want to change the server name also to something else. If that’s possible, pls let us know.

  2. Hi Guys,

    I have a problem and it seems I cannot solve it by myself. Please help!!!!

    I want to change my php.ini include_path, tried to edit the /etc/php5/apache2/php.ini which seems to be the right file. when I change the upload_max_file restart apache and load phpinfo() the change takes place for upload_max_file but not for include_path. The actual value is : .:/usr/share/php:/usr/share/pear and it would not change at all.

    Any ideas why and how I could solve the problem?

  3. this is great. How can i hide server system info? When we check some server result is unknown system.

  4. Hey man I do love you!!! Really!!! I had been looking for this information since a long time ago and now I’ve found it! Thanx a lot!!!

Leave a comment

Your email address will not be published. Required fields are marked *