Server Signature Off: What the Check Means and How to Fix It

What is a server signature in HTTP?

The phrase covers two things people mix up. The first is the HTTP Server header, which carries the banner on every response and which RFC 9110 defines. The second is the footer line Apache can print under its own error pages and directory listings, controlled by the ServerSignature directive.

Apache adds a third control. The ServerTokens directive decides how much detail the server banner carries, and its values run from Prod, Major, Minor and Minimal up to OS and Full. Prod gives you a bare Server: Apache, while Full adds the operating system and the version strings of modules that announce themselves, such as PHP or OpenSSL. Apache defaults to Full for ServerTokens and Off for ServerSignature, but Debian and Ubuntu ship a security.conf that sets ServerTokens OS and ServerSignature On.

Real banners look like these, and the first three give an exact version.

Server: Apache/2.4.58 (Ubuntu)
Server: nginx/1.24.0
Server: Microsoft-IIS/10.0
Server: LiteSpeed
Server: cloudflare

The MDN Server header reference gives the neutral definition and advises keeping the detail low, which is the idea behind everything that follows.

Why turn the server signature off?

A vulnerability scanner such as Nmap or Nikto does banner grabbing: it reads the version and matches it against CVE databases. That version disclosure saves an attacker a step of guessing.

Honest limit: Hiding a banner is security through obscurity. Patch management does the real work, and server fingerprinting can still identify software from behaviour.

Still, the change costs nothing, has no meaningful speed impact and takes five minutes, which is why scanners keep flagging it. It is not a Google ranking factor. We test it as information disclosure hygiene, in the same security group as the HSTS check and the directory browsing check.

How SEO Site Checker tests your server signature

Our report sends one plain HTTP HEAD request to the URL you entered, with a 3 second timeout and no browser rendering. Redirects are not followed, so the first response counts, such as the one that sends http visitors to https. Only the Server header is read, never the footer, X-Powered-By or the page HTML.

The exact rule: any non-empty Server header gives a warning. Only a missing or empty header passes.

That strictness surprises many owners. A bare Server: Apache or Server: nginx still warns, so hiding the version alone does not turn the line green, and a warning counts as not passed in the score. A CDN that answers first supplies the header we see, so a site behind Server: cloudflare usually cannot go green here. A failed result means only that our request got no answer.

Run the same test yourself

Use curl to print only the headers, then look for the server line. Use the exact URL you entered in the report, because curl without -L does not follow redirects either. If you typed http:// and the server redirects, both tools read the redirect response, and adding -L shows the final page's headers as a separate test. In DevTools, the Network tab and the first request's Response Headers show the same thing.

curl -sI https://example.com/

Check my website

How to turn the server signature off in Apache

Edit httpd.conf or apache2.conf, or on Debian and Ubuntu the conf-available/security.conf file, which is enabled by default (run a2enconf security only if you switched it off). A control panel such as cPanel may keep its own include, so check that nothing loads after your line.

ServerTokens Prod
ServerSignature Off

ServerTokens is allowed in server config only. If you put it in .htaccess, Apache returns a 500 Internal Server Error for that directory and logs "ServerTokens not allowed here", so remove it and edit the main config instead. ServerSignature is the one you can set in .htaccess, provided AllowOverride permits it (guides usually cite FileInfo, while the Apache reference lists the level as All), and it only hides the footer on error pages. Apply the change with apachectl configtest, then reload with systemctl reload apache2 or systemctl reload httpd.

The limit: ServerTokens Prod leaves Server: Apache in place, and on Apache 2.4.52 our own test showed that mod_headers with Header always unset Server did not remove it either. Core Apache settings therefore cannot turn the report line green. The route to a pass is a reverse proxy in front that clears the header, such as nginx with headers-more. The official Apache ServerTokens documentation lists every value and what each one sends.

Server signature off in nginx, IIS and LiteSpeed

Only some servers can remove the header instead of trimming it. The nginx server_tokens reference covers the syntax and the contexts it works in.

With nginx, run nginx -t and then reload. The headers-more module ships as libnginx-mod-http-headers-more-filter on Debian and Ubuntu and is bundled in OpenResty. Only NGINX Plus has the string form of server_tokens that can empty the header, and our nginx 1.24.0 test confirmed both results above.

On IIS, the attribute needs Windows Server version 1709 or later, so 2019 and newer, and Windows Server 2016 ignores it. X-Powered-By is a separate header with its own setting, often added by PHP applications. In LiteSpeed WebAdmin, find Server Signature in the server's General settings, where Hide Full Header is Enterprise only.

On a CDN, shared hosting or a hosted site builder, the provider owns the header, so ask them or accept the warning. The hosting checker shows who answers for your domain, and the CDN usage test confirms whether a CDN sits in front.

Why your server signature still shows after you turn it off

Each cause leaves its own fingerprint. If the footer vanished from your 404 page but Server: Apache/2.4.58 (Ubuntu) still arrives, you changed ServerSignature when the header belongs to ServerTokens.

If the version survives ServerTokens Prod, another file is probably winning. Debian and Ubuntu load conf-enabled/security.conf, and a later include can set the value back. Find each copy with grep -ri servertokens /etc/apache2 /etc/httpd, check the load order with apachectl -t -D DUMP_INCLUDES, and reload once more.

Sometimes the header is not yours at all. A proxy or CDN adds its own, which is why Server: cloudflare can replace your Apache line. Request the origin directly with curl -sI -H "Host: example.com" http://203.0.113.10/, using your own server IP. A bare Apache there and the CDN on the public URL means your setting works.

Last, check what you tested. An http address that redirects reports on the redirect response, and a cached copy can show a header the live page no longer sends.