server_tokens
An nginx setting that, when left on, exposes the exact nginx version number in every response, giving attackers a head start on finding version-specific vulnerabilities.
Why this is an easy, low-risk fix
Turning server_tokens off removes version information from every response with a single configuration line and no functional impact on the site, making it one of the highest-value, lowest-effort changes available on an nginx server.
What it does not protect against
Hiding the version number reduces easy reconnaissance but does not fix any actual vulnerability. A server hiding its version while still running genuinely outdated, vulnerable software is only marginally safer than one that reveals it.
Frequently asked questions
Does hiding the nginx version make the server secure?
No, on its own it only removes one piece of reconnaissance information; keeping nginx itself updated is what actually closes known vulnerabilities.
How is server_tokens disabled?
By setting "server_tokens off;" in the nginx configuration, typically in the http block, and reloading nginx for the change to take effect.
Do other web servers have an equivalent setting?
Yes, most web servers have some form of version-suppression option, often under a similarly named directive, though the exact syntax differs by software.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab