Hide HTTP headers in nginx

[Reinis Rozitis]

> As part of the security audit, I have set server_tokens off; in /etc/nginx/nginx.conf. Is there a way to hide Server: nginx, X-Powered-By and X-Generator?
> 
> To hide the below HTTP headers 
> 
> Server: nginx
> X-Powered-By: PHP/7.2.34
> X-Generator: Drupal 8 (https://www.drupal.org)

Afaik the Nginx header is hardcoded, so to remove it you have either to change the source/recompile or run through a proxy which can remove http headers.

For the php header you have to change php.ini and set: expose_php = Off

For Drupal there are several modules/plugins which let you remove the header (for example https://www.drupal.org/project/remove_http_headers )


rr