# Apache Obfuscation by disabling trace and server tokens — Liran Tal

Preventative measures to mitigate leaking the server software running

Canonical: https://lirantal.com/blog/2015-03-09

Apache Obfuscation can be achieved very easily and the benefits are great – it doesn’t disclose server information such as versions, OS, and does output verbose errors when ‘bad things happen’, and they happen.

[![2870445260\_82be0db1db\_z](https://web.archive.org/web/20150312155601im_/http://enginx.com/wp-content/uploads/2015/03/2870445260_82be0db1db_z.jpg)](http://enginx.com/wp-content/uploads/2015/03/2870445260_82be0db1db_z.jpg)

Edit apache configuration, usually available here for RedHat based distributions: `/etc/httpd/conf/httpd.conf`

Make sure the following settings are present, save, and restart apache:

```
TraceEnable Off
ServerSignature Off
ServerTokens Prod
```

How do we test that this is actually working?

## How to TraceEnable

```
1. curl -v -X TRACE http://…
2. Confirm you get a forbidden response
```

## How test ServerTokens

1.  Make a request to the website and check the response headers
2.  Confirm the response contains only “Apache” information in the Server header

## How to test ServerSignature

1.  Make a request to the website for a URL that should respond with Apache server error
2.  Confirm you don’t see information about the apache server software version, OS, etc.

## More writing

[All writing →](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications ↗](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)