{
 "id": 69747,
 "slug": "hiding-server-version-information-from-hackers",
 "url": "https://agents.willem.com/en/snippets/hiding-server-version-information-from-hackers/",
 "language": "en",
 "title": "Hiding server version information from hackers",
 "subtitle": "Web, mail, FTP and SSH servers all leak versions by default.",
 "summary": "Version numbers let hackers look up known vulnerabilities for your exact software. In 2018 I stripped them from HTTP headers, mail server hello banners, x-powered-by headers, FTP greetings and OpenSSH, which advertised operating system information by default.",
 "topics": [
  "SSH",
  "cloud",
  "cyber-security",
  "data",
  "hacking",
  "howto",
  "linux",
  "networking",
  "programming",
  "server",
  "web",
  "work"
 ],
 "date": "2018-03-10",
 "published": "2018-03-10T00:00:00+01:00",
 "created": "2026-08-30T07:13:21.444000+02:00",
 "updated": "2026-08-30T07:16:47.119000+02:00",
 "full_article_url": "https://willem.com/en/2018-03-10_cyber-security-5-easy-tips-to-protect-your-server-against-hackers/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "Why should you hide server version information, and where does it leak?",
 "text": "Every server type leaks somewhere. Web servers like Apache, NGINX and IIS put versions in HTTP headers. Mail servers such as Postfix, Exim, Dovecot and Sendmail announce theirs in the hello banner right after an SMTP, IMAP or POP3 connection. PHP, .NET and Java add an x-powered-by header. WordPress leaks through HTML output and the filenames of CSS, JavaScript and images from plugins and themes. FTP, SFTP and WebDAV servers greet you with their version before you even authenticate, and OpenSSH communicates operating system version info by default.\nHiding versions is one of five measures I recommend, next to installing less software, a firewall that blocks by default, SSH key authentication instead of passwords, and checking logs and updates regularly.",
 "markdown_url": "https://agents.willem.com/en/snippets/hiding-server-version-information-from-hackers/snippet.md"
}