What is the function of ServerTokens in the httpd conf file?
Sarah Martinez
Updated on April 03, 2026
The ServerTokens directive sets the value of the Server HTTP response header field. The ServerName , UseCanonicalName and UseCanonicalPhysicalPort directives are used by the server to determine how to construct self-referential URLs.
What is ServerTokens prod?
The first one, ServerSignature Off tells apache not to display the server version on error pages, or other pages it generates. The second one ServerTokens Prod tells apache to only return Apache in the Server header, returned on every page request.
What is Apache ServerTokens?
ServerTokens. It determines if the server response header field that is sent back to clients contains a description of the server OS-type and info concerning enabled Apache modules.
What is the server signature for Apache?
The ServerSignature appears on the bottom of pages generated by apache such as 404 pages, directory listings, etc. The ServerTokens directive is used to determine what Apache will put in the Server HTTP response header.
What is ServerRoot in httpd conf?
ServerRoot. The ServerRoot directive specifies the top-level directory containing website content. By default, ServerRoot is set to “/etc/httpd” for both secure and non-secure servers.
What is server signature?
A server signature is the public identity of your web server and contains sensitive information that could be used to exploit any known vulnerability. Turning your server signature OFF is considered a good security practice to avoid disclosure of what software versions you are running.
How do I hide Apache on error pages?
To prevent to display such information to the world, you need to make some changes in Apache main settings file. Open configuration data file within your selected editor tool and search for “ServerSignature”, it’s by default “On”.
Does Apache not show version?
How to Hide Apache Version from HTTP Header
- Check Unsecure HTTP Header. Check the HTTP header of your server, You will see the version of Apache2 server running. Hackers can use this information for hacking.
- Hide Apache Version. Edit your Apache configuration file and Add/Edit following variables.
- Check HTTP Header.
What is a server signature?
How do I change my Apache banner?
Apache – Change the server identification banner
- Install the Apache server and the required packages.
- Verify the configured Apache token.
- Here is the command output.
- Verify the Apache header.
- Here is the command output.
- Edit the Apache configuration file.
- Here is the file, before our configuration.
What does servertokens prod do in Apache?
What the second line ServerTokens Prod does is to suppress a server token in HTTP response headers to a bare minimal. So with both lines in place, Apache will not reveal Apache version info in either web pages or HTTP response headers. Another potential security threat is PHP version info leak in HTTP response headers.
What happens if I remove the second line servertokens prod?
However, without the second line ServerTokens Prod, Apache server will still include a detailed server token in HTTP response headers, which reveals Apache version number. What the second line ServerTokens Prod does is to suppress a server token in HTTP response headers to a bare minimal.
What is the servertokens Directive and how to use it?
The ServerTokens Directive controls the response which server sends to include the server details, OS and other complied modules. ServerTokens can have various values. Here are the outputs of each different values
What is the difference between pidfile and servertokens?
The PidFile specifies the file that Apache writes its process ID number to. The path selected is the default. It is mentioned here so you don’t have to look for this path in the documentation later on. ServerTokens defines how the server identifies itself.
