The Server header reveals the software version

What it is

The web server sends a Server header in every response and names its software in it, often with the exact version, for example Apache/2.4.25 (Debian). We read it from the response to an ordinary request and verify nothing else.

This is a recommendation, not an acute hole. The version is what matters. The bare server name tells an attacker little.

Why it’s a problem

From the version an attacker immediately knows which known vulnerabilities to try, with no probing needed.
The header does not attack your site by itself. Hiding the version does not fix it either: an outdated server stays outdated.
So treat hiding it as extra tidying. The real fix is updating.

How to fix it

1. Update

If the header shows a version that no longer gets security fixes, update the server. This is the main step.

2. Hide the version

nginx:

# in the http block (nginx.conf)
server_tokens off;

Apache:

ServerTokens Prod
ServerSignature Off

PHP (the X-Powered-By header):

expose_php = Off

IIS: on IIS 10 turn the header off by setting removeServerHeader="true" in requestFiltering in web.config.

3. Verify

curl -sI https://example.cz/ | grep -i '^server'

If a CDN or reverse proxy sits in front of the server, it may be the one sending the header. Look for the setting there.