Hide HTTP headers in nginx

Reinis Rozitis r at roze.lv
Fri Nov 13 10:03:14 UTC 2020

> As part of the security audit, I have set server_tokens off; in /etc/nginx/nginx.conf. Is there a way to hide Server: nginx, X-Powered-By and X-Generator?
> To hide the below HTTP headers 
> Server: nginx
> X-Powered-By: PHP/7.2.34
> X-Generator: Drupal 8 (https://www.drupal.org)

Afaik the Nginx header is hardcoded, so to remove it you have either to change the source/recompile or run through a proxy which can remove http headers.

For the php header you have to change php.ini and set: expose_php = Off

For Drupal there are several modules/plugins which let you remove the header (for example https://www.drupal.org/project/remove_http_headers )


More information about the nginx mailing list