How to Conceal Server Version Information in Nginx, Apache, and Tomcat

Nginx

Edit src/core/nginx.h and replace the values of NGINX_VERSION and NGINX_VER with custom placeholders (e.g., "***"), then recompile Nginx.

#define NGINX_VERSION "1.18.0"      ===> "***"
#define NGINX_VER "nginx/" NGINX_VERSION ===> "***" NGINX_VERSION

Apache

Edit include/ap_release.h and change the definition of AP_SERVER_BASEPRODUCT to a custom string.

#define AP_SERVER_BASEVENDOR "Apache Software Foundation"
#define AP_SERVER_BASEPROJECT "Apache HTTP Server"
#define AP_SERVER_BASEPRODUCT "Apache"  ===> "******"

After recompiling, add the following directives to httpd.conf to suppress version information:

ServerSignature Off
ServerTokens Prod

Tomcat

Extract ServerInfo.properties from catalina.jar using the JDK jar command, edit the file to replace version values, then repack the JAR.

cd tomcat/lib
jar -xf catalina.jar org/apache/catalina/util/ServerInfo.properties

Modify the extracted file manually:

server.info=****
server.number=
server.built=

Re‑add the modified file to the JAR and clean up:

jar -uf catalina.jar org/apache/catalina/util/ServerInfo.properties
rm -rf org/