infoSeverity: infoRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Web server configWhere it livesImplementationThis fix is applied in: Web server config. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+1 posture+1 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Server banner: stop advertising your exact software version

Suppressing the Server version string takes your site off the easy-target list for automated exploit scans

The threat

Every HTTP response your site sends carries a Server header. The scanner read yours and it named the software and version underneath: something like Server: nginx/1.14.0 or Server: Apache/2.4.29 (Ubuntu). That string is sent to anyone who asks, every browser, every bot, on every request, for free.

Attackers don’t guess what you’re running, they read it here. They take that exact version, look it up against public vulnerability databases, and lead with the exploits already known to work on that specific build. Suppressing the version doesn’t patch anything, and it isn’t a cure on its own, but it takes you off the “easy, known-vulnerable” list the automated scanners sort by first.

The exact fix

The version leaks from the web server, so that’s where you strip it. Lead with your stack:

nginx (server_tokens off;):

# nginx.conf, inside the http { } block
http {
    server_tokens off;
    # ...
}

This trims nginx/1.14.0 down to just nginx, and drops the version from nginx’s default error pages too.

Apache (ServerTokens + ServerSignature):

# httpd.conf or a conf.d/*.conf file (server-wide, not .htaccess)
ServerTokens Prod
ServerSignature Off

ServerTokens Prod trims the header to just Apache, and ServerSignature Off removes the version line Apache prints on its own error pages.

Want the header gone entirely? Core nginx can only blank the version, not delete the Server line. To remove it completely, load the headers-more module and add:

more_clear_headers Server;

On Netlify, Vercel, Cloudflare Pages and similar managed hosts you don’t set this yourself. They already return only a bare product name (for example Server: Netlify) with no version, so there’s nothing to strip. If your scan flagged a version, you’re on a server you control, use the block for your stack above. These directives only take full effect after a reload or restart of the web server.

Verify it

curl -sI https://yourdomain.com | grep -i '^server:'

A good result is a bare product name with no version (Server: nginx, Server: Apache, Server: Netlify), or no Server line at all. A version and OS (nginx/1.14.0, Apache/2.4.29 (Ubuntu)) means it’s still leaking.

Proof

The ApeCyber scanner reads this header passively on every scan, from the outside, exactly the way any browser does, touching nothing. apecyber.com runs on Netlify with hardened headers and grades A / 100, and its responses carry no server version for anyone to look up. Suppressing yours is a 5-minute, −1 cleanup that quietly drops you off the automated shortlist.