如何隐藏Apache/Nginx/PHP版本号

如何隐藏Nginx/Apache/PHP版本号

1、隐藏Tengine(NGINX)版本号
未设置之前:

[root@localhost ~]#curl -I http://192.168.2.12
HTTP/1.1 200 OK
Server: Tengine/2.3.0
Date: Thu, 09 May 2019 14:52:09 GMT
Content-Type: text/html
Content-Length: 555
Last-Modified: Thu, 09 May 2019 10:50:58 GMT
Connection: keep-alive
ETag: “5cd40612-22b”
Accept-Ranges: bytes

隐藏Tengine(NGINX)版本号：

[root@localhost ~]# grep server_tokens /usr/local/nginx/conf/nginx.conf
server_tokens off;
#在http加上 server_tokens off

设置之后:

[root@localhost ~]# curl -I http://nginx.lsp.com
HTTP/1.1 200 OK
Server: Tengine
Date: Thu, 09 May 2019 14:30:28 GMT
Content-Type: text/html
Content-Length: 555
Last-Modified: Thu, 09 May 2019 10:50:58 GMT
Connection: keep-alive
ETag: “5cd40612-22b”
Accept-Ranges: bytes

---

2、隐藏Apache/PHP版本号
未设置之前:

[root@localhost ~]# curl -I http://192.168.2.10/
HTTP/1.1 200 OK
Date: Thu, 09 May 2019 14:36:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Connection: close
Content-Type: text/html; charset=UTF-8

隐藏Apache版本号：

[root@localhost ~]# grep expose_php /etc/php.ini
expose_php = Off
#expose_php = On

隐藏PHP版本号：

[root@localhost ~]# grep -iE “ServerSignature|ServerTokens” /etc/httpd/conf/httpd.conf
ServerTokens Prod
#ServerTokens OS
ServerSignature Off
#ServerSignature On

设置之后:

[root@localhost ~]# curl -I http://192.168.2.10/
HTTP/1.1 200 OK
Date: Thu, 09 May 2019 14:36:29 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=UTF-8

说明：
ServerSignature Off告诉Apache在错误页(HTTP Status 404之类)不显示服务器版本信息。默认为Off。
ServerTokens Prod告诉Apache在服务器头信息中(Server Header)中只返回Apache，不返回服务器操作系统与Apache的版本信息。