Less informative HTTP Response Header

[Daevon]

Hi Everyone
since I've had a number of attacks lately, I'd want to make my HTTP Response header less.. informative (it's a known best practice after all)

Currently, it is:
Date →Wed, 01 Jun 2016 21:26:51 GMT
Server →Abyss/2.11.1-X1-Win32 AbyssLib/2.11
(I removed the "X-Powered-By →PHP/5.6.0" by setting "expose_php = off" in php.ini)

Is there any way to remove the sensitive data (ie Abyss version)?

Thanks!

[admin]

Daevon,

The server header cannot be removed in X1.

By the way, hiding it won't prevent attackers from knowing the type of server you're using. Each server has its behavioral "signature" that can be fairly easily inferred from a few request/response tests.

That being said, the knowledge of the Web server type won't help the attacker a lot. So far, there are no know vulnerabilities in Abyss Web Server that could be exploited to do any harm.
_________________
Follow @abyssws on Twitter
Subscribe to our newsletter
_________________
Forum Administrator
Aprelium - https://aprelium.com

[Toasty]

Set up a reverse proxy in front of it (HA Proxy, etc) and strip the header. Multiple hosts can be configured using this as well.
_________________
Audit the secure configuration of your server headers!