For example, when I dump the response header for my server I get:

Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g

Is this used for anything? Is it a security risk (albeit small) broadcasting the server makeup?

2 Answers 2


No, it is not used for anything important. (Netcraft's server market share surveys probably use it, as presumably do other 3rd party surveys.)

Yes, it is a (very) small security issue. Of course your server should be secured and up to date at all times, but having an extra layer of 'obscurity' on top of a well secured server is only beneficial. If nothing else, if an attacker needs to undertake extensive 'fingerprinting' before attacking, then you might get some early warning of an attack if you monitor your logfiles closely.

You can safely turn down the level of detail being broadcasted if you want to. On the other hand, it isn't a big deal, and if you're on a shared server where you cannot change this, then don't sweat it.


With a Server header that long, shortening it or getting rid of it entirely could also provide a tiny performance benefit.

As Jesper notes, it's not a big issue, but if you're trying to squeeze out every extra millisecond from your page load times, it could make a difference — particularly if you're loading lots of small files, which is bad from a performance viewpoint in itself, but sometimes unavoidable.

I suspect that's one reason why, for example, Google's webservers just say:

Server: gws


Server: sffe

Sure, they could've spelled out "gws" as "Google Web Server" without disclosing any more information, but that would add 14 completely useless bytes to every HTTP response. With Google's request volume, those few bytes might well add up to more bandwidth than your average small website uses in total.

  • Packet sizes are typically around 1,000 bytes, so saving a few bytes will (literally) have no effect on speed. Only if the total of all headers spills over into an extra packet. Commented Jun 22, 2012 at 14:00
  • A 100-byte header, like the one quoted in the question, might well cause the combined length of the response headers and content to spill over into an extra packet. Besides, packet-counting tells the whole story only for purely latency-limited connections. In (at least partially) bandwidth-limited situations (such as slow mobile connections, or large data centers with a huge request volume), the total amount of bytes transmitted starts to matter too. Commented Jan 27, 2014 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.