How to hide Apache2 Server Information.

Oct 28, 2026

—

Removing the server header can help hide information about your web server. This information could be used to see if your web server is running a vulnerable version. This is called banner grabbing.

A hacker will attempt to get the version of a service. It won’t prevent being exploited but it could make it harder for the hacker to figure out what version of Apache2 you are running.

Using the command below any one can get the server brand and version just using cURL.

curl -I michaelmeade.org

The -I argument is what will return server head information. See below for an example.

HTTP/1.1 301 Moved Permanently
Date: Sun, 25 Oct 2026 19:32:56 GMT
Server: Apache/2.4.10 
Location: https://michaelmeade.org/
Content-Type: text/html; charset=iso-8859-1

First we have to install mod security with the following command.

sudo apt-get install libapache2-mod-security2

Now we need to edit Apache2’s config file that is located at /etc/apache2/apache2.conf.

Lastly you have to add the following text to the end of the apache2.conf file.

<IfModule security2_module>
    SecRuleEngine on
    ServerTokens Min
    SecServerSignature "MountainDew"
</IfModule>

Look at SecServerSignature, this is where the server name is stored. You can change it to anything you want. In the example above the server header will say America.

Lastly we have to restart the Apache2 service so that the change takes place. Use the command below.

sudo service apache2 restart

In my example I changed it to America. Once again we will use cURL to see if the change took place.

HTTP/1.1 301 Moved Permanently
Date: Sun, 25 Oct 2026 19:45:19 GMT
Server: MountainDew
Location: https://michaelmeade.org/
Content-Type: text/html; charset=iso-8859-1

Look at that! The server is displaying MountainDew.

apache2