How to hide Nginx version number in headers and errors pages

By /

In default Nginx configuration, the server sends HTTP Header with the information of Nginx version number of the Server. The HTTP response header “Server” displays the version number of the server. This information can be used by hackers to try to exploit any vulnerabilities in the Nginx, specially if you are running an older version with known vulnerabilities.

Sample HTTP Response Header:

HTTP/1.1 200 OK
Server: nginx/1.2.6 (Ubuntu)
Date: Wed, 31 Jul 2013 19:47:33 GMT

Note: This is just one way to identify the details. Also, even if this information is not available hackers might still try to hack it using other ways.

There is an easy way to hide the Nginx version number from the HTTP headers. By setting the “server_tokens” variables in your nginx.conf file the server information would not longer be added to the HTTP headers. Use the following lines in you nginx.conf file. Make sure to back up you file before editing so that in case something goes wrong you can easily revert. After making the changes restart your nginx (Note: Doing so will take your site down, if it runs only on 1 server).

server_tokens off;
After using the above directives the HTTP headers will look similar to this:
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 31 Jul 2013 19:49:15 GMT
Note: Make these changes in your server only if you are sure you know you can do them. If you make a mistake in the nginx.conf file, your site won’t work. So be very careful when making these changes. Also, it is always good to take a backup of the existing file before making any changes, in case you want to revert.

Related posts:

  1. How to hide apache information with ServerTokens and ServerSignature directives
  2. How to hide PHP version in the HTTP Headers
  3. How to remove WordPress version number
  4. Creating multiple virtual hosts/websites in Wampserver

2 thoughts on “How to hide Nginx version number in headers and errors pages”

Leave a Reply