So is there any way to hide X-Powered-By on Nginx?
-
1x-powered-by is often added by the module for a certain language -- e.g. PHP -- and not the server itself. What value do you have in the header?– CheekysoftJun 7, 2009 at 16:33
-
1Details, please? Should be closed if you can't supply any details to allow someone to answer.– John SaundersJun 7, 2009 at 16:52
-
2-1: This should asked on SF as it is related to the running of servers, not programming.– Robert MacLeanJul 9, 2009 at 6:02
-
@RobertMacLean Agreed, but you can just flag it - I think it should be moved too, but it's a good question.– mikemaccanaSep 23, 2015 at 8:44
7 Answers
proxy_hide_header X-Powered-By;
-
4I tried adding it to the http {} section and to the server {} section but it still keeps setting it. X-Powered-By: PHP/5.4.14– dknightApr 24, 2013 at 14:32
-
2Confirmed that works with proxy_pass on nginx/1.1.19. Documentation nginx.org/en/docs/http/…. No modules or fastcgi in use.– h-kippoJan 14, 2015 at 6:11
-
-
-
21If you use fastcgi, you must use
fastcgi_hide_header X-Powered-By;
. Mar 3, 2017 at 14:06
x-powered-by is given by the module, for instance php fastcgi module offers to set expose_php=Off
in php.ini
-
6
-
2proxy_hide_header X-Powered-By; in conf doesn't work on nginx/1.11.9 and this solution works. This should be accecpted answer. Feb 15, 2017 at 9:29
-
1With geerlingguy/ansible-role-php you can use the param: php_expose_php: "Off" (github.com/geerlingguy/ansible-role-php)– SantiJan 29, 2018 at 22:42
-
1On ArchLinux I had to restart
php-fastcgi.service
to get this to work.. Thank You.– ArchNoobAug 25, 2018 at 21:26
Try to use the more_clear_headers directive from the nginx's HttpHeadersMoreModule which can allow you to declare:
more_clear_headers 'X-Powered-By';
which should do just what you want.
-
This did not work for me, and I believe it requires a source compile for nginx to enable: serverfault.com/questions/214242/can-i-hide-all-server-os-info– efickerMay 23, 2016 at 17:38
Nginx
Open this file
$
sudo vi /etc/nginx/nginx.conf
Find the HTTP section, this section defines configurations for Nginx's HttpCoreModule. Add the below directive:
$
server_tokens off;
This will configure Nginx not send any version numbers in the HTTP header.
(Removing the server name is possible, however, since Nginx modules cannot be dynamically loaded, you would need to recompile Nginx from source with the HttpHeadersMoreModule Nginx module.)
Reload Nginx configuration To apply the change, reload Nginx service:
$
sudo service nginx reload
PHP
For server security reasons, it is recommended that you disable or hide this information from attackers who might be targeting your server by wanting to know whether you are running PHP or not.
Step 1.
$ `sudo nano /etc/php.ini`
Find the keyword expose_php and set its value to Off:
$
expose_php = off
If you're running PHP as FPM, then you'll need to reload PHP-FPM
$
sudo service php-fpm reload
After reloading, the response header X-Powered-By: PHP/7.2 should be missing.
#nano /etc/nginx/nginx.conf
comment this line
more_clear_headers 'X-Powered-By';
and restart Nginx