Updated: 22 October 2026 · Applies to: Apache HTTP Server on any Linux distribution
Hiding Apache's version number on error pages and in the Server response header is a good security practice: broadcasting the exact software version helps an attacker target known vulnerabilities for that version. Without this change, Apache shows details similar to:
Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8b PHP/5.2.6 Server at example.com Port 80
Edit the Apache configuration
Add or edit these two directives in Apache's main configuration file (httpd.conf, or conf.d/security.conf on a cPanel/WHM server):
ServerSignature Off ServerTokens Prod
ServerSignature Off stops Apache printing the version on error pages and other auto-generated pages. ServerTokens Prod makes Apache return only the word "Apache" in the Server header on every response, with no version or module list.
Restart Apache
service httpd restart
Confirm it worked
Request any page on the server and look at the Server response header:
curl -I https://your-domain.example/
It should now read Server: Apache, with no version number, operating system or module list after it. To see the change on an error page as well, request a path that does not exist and check the footer line of the 404 page.
This hides Apache's own version string, but it does not hide PHP's. If PHP also reports its version in response headers, turn that off separately by setting expose_php = Off in php.ini and restarting PHP-FPM (or Apache, on a mod_php setup).
