Server: what software answered the request
Server identifies the software that produced the response. It is informational, and a detailed version string is a small but genuine disclosure.
At a glance
- Direction
- Response only. The request side counterpart is User-Agent.
- Defined in
- RFC 9110
- When absent
- Nothing breaks. The header is optional and plenty of production sites omit it.
- Value
- Product tokens with optional versions and comments
- Common practice
- Trim to a product name with no version, or remove it altogether.
- Related disclosure
- X-Powered-By, and framework specific headers that leak more detail
- Diagnostic use
- Identifying which layer of a proxy chain generated an error page
In detail
The value is a list of product tokens, and the detail people worry about is the version. Publishing an exact version tells an automated scanner whether a published vulnerability applies before it sends a single probe. That is not the main line of defence, since a scanner will simply try anyway, but it does cheaply remove your site from lists built by matching on version strings.
The realistic advice is to trim rather than fight over it. A product name with no version keeps the diagnostic value while removing the part that matters, and it is a configuration change rather than a code change. Removing the header entirely is fine too, and nothing in HTTP depends on it being present.
Its diagnostic value is real when several layers are involved. A response carrying the name of your edge rather than your application usually means the error page came from the edge, which narrows a problem in seconds. Losing that signal is the small cost of stripping the header.
Do not confuse a trimmed header with hiding your stack. Response header order, cookie names, error page wording and TLS handshake details all identify software just as well. Treat this as tidying rather than as a security control, and make sure the software behind it is patched either way.
Examples
Server: Apache/2.4.58 (Ubuntu) OpenSSL/3.0.13Server: Apachecurl -sI https://example.com | grep -i '^server:'Things that catch people out
- Removing the header does not anonymise the stack. Header ordering and error page wording identify software just as reliably.
- In a proxy chain the value usually comes from whichever layer generated the response, so it can change between a cache hit and a miss.
- Some monitoring and compliance tooling parses this header, so stripping it can quietly break a dashboard nobody remembers owning.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →X-Powered-By: a header worth removing
What X-Powered-By discloses, why frameworks add it by default, what removing it actually buys you, and which related headers leak the same information.
Via: the proxies a message passed through
How Via records each intermediary, what the protocol and pseudonym fields mean, how it detects request loops, and why it is useful when debugging a cache.
User-Agent: what the client says it is
Why User-Agent strings look the way they do, why browsers are freezing and reducing them, and what to use instead of parsing one for feature decisions.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Forwarded: the standardised proxy header
The syntax of the standard Forwarded header, how it replaces the X-Forwarded set, how to quote IPv6 addresses and ports, and how far to trust it.
X-Forwarded-For: the client address behind a proxy
How the X-Forwarded-For list is built, why the leftmost address is not trustworthy, how to count trusted hops, and what breaks rate limiting behind a proxy.
Tools for this
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body