> As part of the security audit, I have set server_tokens off; in > /etc/nginx/nginx.conf. Is there a way to hide Server: nginx, X-Powered-By and > X-Generator? > > To hide the below HTTP headers > > Server: nginx > X-Powered-By: PHP/7.2.34 > X-Generator: Drupal 8 (https://www.drupal.org)
Afaik the Nginx header is hardcoded, so to remove it you have either to change the source/recompile or run through a proxy which can remove http headers. For the php header you have to change php.ini and set: expose_php = Off For Drupal there are several modules/plugins which let you remove the header (for example https://www.drupal.org/project/remove_http_headers ) rr _______________________________________________ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx
