Remove Server Header from HTTP Response with Apache

How to Remove the Server Header from HTTP Response in Apache

Removing the server header in HTTP responses is a helpful security practice for web administrators.

Why You Should Remove the Server Header

The server header in HTTP responses provides information about the software running on the server, which can be leveraged by malicious users for attacks. Thus, it’s advisable to eliminate this header to enhance security.

Steps to Remove the Server Header

Here's how to effectively remove the server header from HTTP responses:

1. Open your Apache configuration file (httpd.conf or a virtual host file).
2. Add the following line to the configuration: Header unset Server.
3. Save changes and restart Apache for the changes to take effect.

Detailed Configuration Instructions

Depending on your setup, the configuration file may vary in location. Commonly, it can be found in locations like:

• /etc/httpd/conf/httpd.conf
• /etc/apache2/apache2.conf
• /usr/local/apache2/conf/httpd.conf

Using .htaccess to Remove Server Header

If you are on shared hosting or don't have access to configuration files, you can also utilize the .htaccess method:

1. Create or edit the .htaccess file in your web root directory.
2. Add the line: Header unset Server.
3. Save the changes.

Considerations When Modifying Headers

When removing the server header, you might also consider modifying other response headers that might expose sensitive information:

• Remove the X-Powered-By header by configuring PHP settings.
• Use ServerTokens Prod in your configuration to minimize information leakage.

Conclusion

By following the steps outlined above, you can effectively enhance the security of your web applications by removing the server header from HTTP responses. This makes it difficult for potential attackers to ascertain details about your web server.

Update: 17 Jun 2026