I have web Apache servers with Jessie or Stretch that have been upgraded successively from older versions of Debian (from Squeeze onwards, depending on the servers).
In all of them, I have Apache with
security.conf having configured the directives
ServerTokens Prod and
ServerSignature off according to this question The Hosting History OS is unknow in the www.netcraft.com .
I also have checked out
security.conf is present in the
conf-enabled directory in all of them (it is).
Now it comes the most interesting part; some of them do not honour that configuration; and some of them do. The only pattern I was able to establish is that recently installed servers with Apache configured from scratch do not exhibit that behaviour (e.g. they always honour the configuration).
What could be happening?