dotvitals

The server announces its exact version

LowConfirmedQuick winweb.security-headers.server-version-disclosed

What this check looks for

Every response says which software you run and which version. That turns 'find a vulnerable site' into a search query.

Why it matters

Hiding the version does not make you secure, and it does remove you from the automated scans that look for a specific version with a known vulnerability. It costs one line to change.

When the check passes, your report says: “The server keeps its exact version to itself”.

What it costs your score

When this check fails it removes 3 points from your Web security score, before the status, confidence and repeat multipliers are applied. Web security carries a weight of 8 in the overall score.

It shares the web-security.disclosure family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Web security. One underlying problem showing up in several places is still one problem.

Severity
low
Default confidence
confirmed
Status when triggered
warn
Deduction
3 points
Family cap
web-security.disclosure · 10
Category
Web security
Module
Web security headers
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Drop the version number from the Server header.

The version is what automated scanners match on.

  1. nginx: server_tokens off; in the http block.

  2. Apache: ServerTokens Prod and ServerSignature Off in the main configuration — not in .htaccess, which cannot set them.

  3. Keep patching regardless; this is noise reduction, not a fix.

How to confirm it worked

  • curl -sSI https://‹host›/ | grep -i '^server:' — expect no version number

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx
http {
	server_tokens off;
}
Apache
ServerTokens Prod
ServerSignature Off
Caddy
header {
	-Server
}
Cloudflare
Cloudflare replaces the origin's Server header with its own on proxied responses.

  • This removes the version but leaves the product name. Removing the header entirely needs the headers-more module or a proxy in front.

  • Shown because the response identified Apache. Both are main-configuration directives; .htaccess cannot set either, so advice to put them there does not work.

  • Caddy sends Server: Caddy with no version, so removing it is optional.

  • A Transform Rule adds the header at Cloudflare's edge, so it applies only to responses that reach visitors through Cloudflare. An origin that is reachable directly — by IP, or through a DNS record that is not proxied — still serves the response measured here without it. Setting it at the origin covers both paths.

Technical detail

Server: ‹value› carries a version number. This rule owns the Server header; a version the page publishes in its own markup is reported separately by web.technology.cms-version-disclosed, so neither channel is counted twice.

Note the distinction this rule draws: Server: nginx is not reported, because the product name is inferable from behaviour anyway and no advice would be taken. The version is the part that maps directly onto a CVE list, and dropping it is a one-line change that people actually make.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the web security headers checkerBuild the fix

Other web security headers checks