How to modify the "Server" header with ModSecurity

Introduction

As an attempt to increase security, some users may find it helpful to be able to hide the "Server" identification header. This article provides the steps to do so.

Please note that there are other ways to determine if a server is running Apache, and that the "Server" identification header does not leak your version information.

Procedure

1. Access the server's command line as the 'root' user via SSH or "Terminal" in WHM.
2. Open /etc/apache2/conf.d/modsec/modsec2.user.conf in your preferred text editor.
3. Locate the SecServerSignature line or add it if it doesn't exist.
4. Set SecServerSignature to the desired value.

   SecServerSignature ' '

   Please note that the value cannot be empty. In the above example, the value is a single space.
5. Save the changes and exit the text editor.
6. Log in to WHM as the ‘root’ user.
7. Navigate to "Home / Service Configuration / Apache Configuration / Global Configuration."
8. Set the "Server Signature" value to On.
9. Set the "Server Tokens" value to Minimal.
10. Scroll to the bottom of the page.
11. Click the "Save" button.
12. Verify that the settings are correct.
13. Click the "Rebuild Configuration and Restart Apache" button.

Additional resources

Global Configuration

ServerSignature Directive

ServerTokens Directive