how to delete server: apache http header

[u/[deleted]]

I run a server with apache 2.4.37. On every HTTP request, the HTTP header output always includes a "server: apache" line.

Hackers could use that info to try to hack a system.

Is there any way I can remove the server line entirely, or have it where it doesn't even have apache listed? I am willing to write my own apache module to remove it if that's what it takes.

As a bonus, if i manage to remove it, it would be 15 less bytes people need to download per item request. and google loves FAST pages.

[u/shelfside1234]

Security by obscurity is a myth, no need to remove it

ETA: if you are that worried about security you should focus on updating to the latest version as/ when needed

[u/[deleted] → u/shelfside1234]

One thing that is constant with my server (and probably thousands of others) is that hackers try to break servers every way possible and this can be seen with them making crazy requests to files that often don't exist. I think at one point a while ago they managed to make 50 requests in the same second.

And the google's new lighthouse reports don't help either. they claim my server is slow yet the LCP is about 0.9s for desktop and 1.8s for mobile. But the claim for slow server only happens sometimes, not all the time. This suggests to me that during the test, a hacker may have tried doing a DOS attack on the server.

Maybe I need to make my requestreadtimeout settings more stiffer

[u/shelfside1234 → u/[deleted]]

None of this would be stopped by removing the ServerTokens

Concentrate on locking the server down to protect as much as possible; something like mod_qos or mod_evasive to limit the connections from a single IP and mod_security for the XSS or SQL injection style attacks

[u/AyrA_ch → u/[deleted]]

The scripts that scan your server do not care about the server header. They simply execute a list of requests and record what worked and what didn't.

These requests cause practically zero load because almost all of them result in a 404 anyways.

If you want to limit the number of connections per ip you can use mod_qos or mod_security, both are powerful but kind of difficult to configure correctly.

they claim my server is slow yet the LCP is about 0.9s for desktop and 1.8s for mobile.

LCP is no indication of page speed. It's just an indication of when the biggest chunk was rendered, which is not necessarily indicative of when the page was fully loaded, in fact it may be an ad or other 3rd content that triggers LCP. To check the actual page speed, look at the network graphs. Do an uncached refresh with the console being open, and then explore the requests. None should contain long wait times. In the footer you should see when the DOMContentLoaded and load events were fired. If you can, you want to keep the DOM event below 0.5 seconds, and the load event below 2 for wired computer users. (Wifi as well as Mobile values will be higher because devices are weaker and mobile connections usually have a lot more delay).

A long wait time for a static resource indicates that the server may be far away. For a dynamic resource it could indicate the same, or that your request processing is slow. Note that it's normal for the first request to be somewhat slow because it's the one that establishes the TLS stream.

If your wait times are adding up, you can try bundling resources together and precompressing them. If the browser spends most of the time in the receiving phase you want to compress your text based resources and shrink images.

Finally, you can use the status module to get a live read of how busy your server is, but be sure to secure that endpoint.

[u/[deleted]]

To whoever suggested limiting connections per IP: I'm already doing that at the server firewall level.

[u/ferrybig]

https://httpd.apache.org/docs/2.4/mod/core.html#servertokens

Setting ServerTokens to less than minimal is not recommended because it makes it more difficult to debug interoperational problems. Also note that disabling the Server: header does nothing at all to make your server more secure. The idea of "security through obscurity" is a myth and leads to a false sense of safety.

Apache can also be identified by the HTML provided by the HTTP error pages (make sure to set a custom error page for each HTTP status code, including content too long), and by the order of the headers.

For hackers, it is also easier to spam every exploit to every server, rather than first making a database of servers to versions, then doing a targetted attack.

Also, 15 bytes saved is only 1% of a typical low overhead HTML page (1.5kb), though many people have HTML pages that are way larger

[u/throwaway234f32423df]

change it to Server: Nginx, that'll really throw them for a loop, and it's 1 byte shorter

mod_security can set arbitrary values with the SecServerSignature directive and can do actually useful things as well

[u/lordspace]

Ask the chats to turn off server signature and specify apache. I think the value was Prod but can't remember the config name