Preventing Server Information Leakage

01

What is Information Leakage?

Information leakage occurs when a website unintentionally reveals internal details about its configuration, software versions, or infrastructure. While this information isn't damaging on its own, it acts as reconnaissance intel for attackers.

For example, if an attacker knows you are running an outdated version of Apache (e.g., 2.4.49), they can look up specific exploits for that version (like Path Traversal CVE-2021-41773) and launch a targeted attack.

02

Common Sources of Leakage

03

The Role of Obscurity

You might hear that "Security through obscurity is not security." This is true—hiding your version number won't patch a vulnerability. However, information hiding is a valid layer of Defense in Depth.

By removing these banners, you satisfy the principle of "Least Privilege" (giving away only what's necessary) and make automated scanning harder for attackers. It forces them to work harder to identify your stack.

04

Hiding Server Signatures

Here is how to disable these headers in common web servers and frameworks.

Nginx

Edit your nginx.conf file inside the http block:

server_tokens off;

This will change the header from Server: nginx/1.18.0 to just Server: nginx.

Apache

Add these lines to your main config or .htaccess:

ServerTokens Prod
ServerSignature Off

PHP

Edit your php.ini file:

expose_php = Off

This removes the X-Powered-By header.

Express.js (Node.js)

Use the built-in method to disable the header:

app.disable('x-powered-by');

Or use a security middleware like Helmet:

const helmet = require('helmet');
app.use(helmet());

05

Testing Your Configuration

After applying changes and restarting your server, verify the headers using `curl` or browser DevTools.

curl -I https://your-website.com

You should no longer see version numbers in the Server or X-Powered-By lines.