Hide the Nginx Version with server_tokens off

1. Why hide the Nginx version?

By default, Nginx can include its version in generated error pages and in the HTTP Server response header. For example:

Server: nginx/1.22.1

That information gives a visitor an unnecessary clue about the software in use. Hiding the version reduces this disclosure, but does not fix vulnerabilities in the server itself. The version above is an example from the original article, not a recommended release.

2. Set server_tokens to off

The server_tokens off; directive suppresses the version number. Nginx generally still identifies itself as nginx; this setting is not intended to remove the entire Server header.

http {
    server_tokens off;

    server {
        listen 80;
        server_name example.com;

        location / {
            root /var/www/html;
        }
    }
}

This is an illustrative configuration fragment. Add the directive to the appropriate existing configuration; do not replace a working configuration with this fragment or create a second nested http block. The example does not configure HTTPS.

3. Choose the appropriate scope

• http: establish the setting for virtual hosts under this block.
• server: apply it to a particular virtual host.
• location: apply it to a particular request location.

Setting it in the http block is a convenient baseline. Check lower-level configuration for overrides rather than assuming the top-level setting is always the effective value.

4. Validate and reload

Test the configuration before reloading Nginx. Run these commands with the privileges required by your installation:

nginx -t                 # Validate configuration syntax
systemctl reload nginx   # Reload only after the test succeeds

Then inspect the response headers using browser developer tools or curl -I against your own site.

Before:

Server: nginx/1.22.1

After:

Server: nginx

If a CDN or reverse proxy sits in front of Nginx, its response may differ from the origin’s response. Check the relevant layer before concluding that the setting did not take effect.

5. Treat this as a small hardening measure

server_tokens off is a straightforward way to avoid unnecessary version disclosure. It is useful as part of a broader hardening checklist, but it is not a substitute for security updates, access controls, secure application configuration, or monitoring.

English translation with a clarification of the security limitations. Commands retain their original behavior; comments are translated. Reference: Nginx server_tokens documentation.

Read the Korean original.