One of the HTTP headers that the Apache httpd sends back with response data is "Server". For example, my web server machine is relatively up-to-date Arch Linux. It sends back headers closely resembling the following:

HTTP/1.1 404 Not Found
Date: Thu, 10 Apr 2014 17:19:27 GMT
Server: Apache/2.4.9 (Unix)
Content-Length: 1149
Connection: close
Content-Type: text/html

I have ServerSignature off in /etc/httpd/conf/httpd.conf, but the "Server:" header still appears. I have experimented with mod_headers. I have it enabled, and I've tried a few things:

<IfModule headers_module>
Header set ProcessingTime "%D"
Header set Server BigJohn

After stopping and starting httpd with the above configuration, the HTTP headers include something like ProcessingTime: 1523, but the "Server:" header line remains unchanged. So I know that "mod_headers" is installed and enabled, and working, but not as I desire.

I see that something called "mod_security" claims to do this, but I don't want all the rest of the baggage that mod_security carries with it.


Once you get mod_security installed, you only need a few directives:

<IfModule security2_module>
SecRuleEngine on
ServerTokens Full
SecServerSignature "Microsoft-IIS/6.0"

That's for mod_security 2.7.7

  • 3
    Have you restarted apache since changing the conf file? Also I've never seen the file called 'httpd.com', usually it's called 'httpd.conf'. Apr 10, 2014 at 18:00
  • @MichaelOzeryansky - thanks for catching the misspelling. It is "httpd.conf" I do stop and start httpd after changing httpd.conf.
    – user732
    Apr 10, 2014 at 18:14
  • By setting ServerTokens Min I was also able to remove the loaded modules (e.g. mod_fastcgi) from the header response that appeared after the blank server name.
    – SharpC
    Jan 26, 2021 at 15:08

4 Answers 4


mod_security is great, but you don't really need it to achieve your goal.

after all mods have been included in httpd.conf you can simply unset the headers of your choosing. As stated in the comments, mod_headers needs to be enabled.

Header unset Server

# if the above doesn't work, set a default value
# use the keyword 'always' to set the header even with error'ed responses
# (e.g. if your app is down)
Header always set Server "No peeking!"

ServerSignature Off
ServerTokens Prod


  • 3
    mod_sec is needed for a custom text to hide completely the work apache otherwise your solution is good and simple :)
    – intika
    Aug 12, 2015 at 18:13
  • This has no affect for me using Apache 2.2 (patched) on Centos 6.
    – jph
    Apr 19, 2016 at 16:35
  • 1
    In Apache 2.4, it is reported as Syntax error : Invalid command 'Header', perhaps misspelled or defined by a module not included in the server configuration
    – Raptor
    May 6, 2016 at 10:07
  • 3
    @Raptor You have to install mod_headers with sudo a2enmod headers Nov 15, 2016 at 15:58
  • 3
    Header unset Server does not work in Apache 2.2 and 2.4. Response headers still contains Server: Apache
    – Maris B.
    Jul 11, 2018 at 8:28

Just updating this for people who are still looking. I was having trouble getting the Server line in the HTTP header changed. This advice should work for Debian branch distros with systemd and Apache 2.4.7. Specifically, I am using Ubuntu Server LTS 14.04.03. Some advice I found was to do

grep -Ri servertokens /etc/apache2

This led me to /etc/apache2/conf-available/security.conf where both ServerTokens and ServerSignature were specified. Therefore, any changes I was making to /etc/apache2/apache2.conf were being overwritten by the directives already specified in security.conf.

I simply changed the directives in security.conf and Apache started working as I wanted.

ServerTokens Prod
ServerSignature Off

On the topic of Header unset Server, I found a bug report where the Apache devs said it is a won't fix issue. Apparently for them it is a philosophical issue, despite that the specification for HTTP/1.1, RFC 2616 authored in part by Tim Berners-Lee, saying that the Server tag is optional.

I really wanted to set the Server tag to "Unknown" to make our Qualys scans happy. So, I installed mod_security, now called libapache2-modsecurity, following this DigitalOcean tutorial. Best of luck, I hope I helped for all you future readers.


The server ID/token header is controlled by "ServerTokens" directive (provided by mod_core). Aside from modifying the Apache HTTPD source code, or using mod_security module, there is no other way to fully suppress the server ID header.

With the mod_security approach, you can disable all of the module's directives/functions in the modsecurity.conf file, and leverage only the server header ID directive without any additional "baggage."

  • This does work, thank you very much. I have to note that mod_security is not one of Arch Linux's ordinary packages. There's a PKGBUILD in the AUR, but it hasn't been updated since 2011 (as of April 12, 2014) and it references a really old version of mod_security. As always, your distro may vary.
    – user732
    Apr 12, 2014 at 16:15

I've tested something on Oracle HTTP Server (which is built on Apache 2.2.22) that worked for me, to some extent..

Setting the "ServerTokens" to "none" seems to remove the "Server" header value, although the header itself keeps being sent in the response, but now it has a null value.

ServerTokens none

The response header would look like this:

HTTP/1.1 200 OK

Date: Mon, 28 Dec 2015 07:02:45 GMT


Last-Modified: Sun, 27 Dec 2015 07:29:13 GMT



  • 2
    On Apache 2.2 stock, from Centos 6 repos, setting a value of "none" causes Apache to output all data. For instance: "Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips Phusion_Passenger/4.0.59 mod_perl/2.0.4 Perl/v5.10.1"
    – jph
    Apr 19, 2016 at 16:36
  • agree, you can't use none on latest Apache: ServerTokens takes 1 argument: 'Prod(uctOnly)', 'Major', 'Minor', 'Min(imal)', 'OS', or 'Full'
    – vladkras
    Apr 23, 2019 at 5:51

You must log in to answer this question.