When I check my headers with some of the websites around, they can tell that I am using Apache.

For example -

Headers returned from: https://example.com

Cache-Control: no-store, no-cache, must-revalidate
Connection: Upgrade, close
Date: Mon, 24 Oct 2022 12:19:06 GMT
Pragma: no-cache
Upgrade: h2,h2c
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT

I am using a shared server. How can I stop this information (Server:Apache) from leaking out using htaccess or php ?

1 Answer 1


I am using a shared server.

Then you probably can't control what is output.

It is defined by Apache directive ServerTokens (https://httpd.apache.org/docs/2.4/mod/core.html#servertokens) which can't appear in .htaccess file, only in main configuration.

More important: what do you think you can achieve by withholding this information?

In practice, not much, because even if not there, there are various other ways to fingerprint a webserver and to know what it runs. Also, for an attacker, knowing there is PHP running on it is far more useful than knowing the underlying webserver used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.