I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the bottom of the page.

What are the security risks/implications, if any, of "advertising" this information? It is better not to reveal that the web server is Apache, and that I used Python and jQuery, for example?


Not really. There are dozens of websites which can reveal this information. And anyone who wants to hurt you will be able to determine what they need to know. Keeping your stack patched up with the latest security fixes is what's important. The components of the stack can be easily sniffed out.

  • "The components of the stack can be easily sniffed out." - So once the administrator takes the time to disable server tokens and otherwise apply basic hardening techniques, how do you propose the components will be sniffed out?
    – danlefree
    Nov 13 '12 at 12:17
  • The question concerned whether advertising the technologies used to build the site will--all other things being equal--lessen the security of the site; it won't. By all means, take steps to harden your site. But, even if server tokens are turned off, a hacker can just go down the list of common servers and common exploits for each. What percentage of sites run on Apache or IIS? Quite a large percentage of them. Not my forte, but I would assume throwing everything against the wall and seeing what sticks is as common, when it comes to server exploits, if not more so, that surgical precision. Nov 17 '12 at 4:53

Showing which technologies you use won't put you at anymore of a security risk. Most hackers will be probing your server to determine it's web server. That's pretty easy to figure out using a number of tools. jQuery you can't hide it's client side and in the source of your web pages. Python is probably detected based on the file extensions just as php files are. Rather than wasting time on worrying about security based on logos you put on your website you should focus on building a better app and improving it. If you want it to be secure use PHPIDS along with other log file monitors on your servers. Keep your software up to date and only have services running which you absolutely need. Then cross your fingers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.