How to fix server version on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce (cloud) uses Fastly as its CDN/edge layer. Log into the Magento Cloud Admin or Fastly control panel and configure a 'Response Header' VCL snippet to unset the Server header: in the Fastly VCL, add `unset beresp.http.Server; unset beresp.http.X-Powered-By;` in the `vcl_fetch` subroutine.
2. For Adobe Commerce (on-premises) on Nginx: edit /etc/nginx/nginx.conf or the site vhost config, add `server_tokens off;` in the `http {}` block, and use the headers_more module to fully remove the header: `more_clear_headers 'Server';`.
3. For on-premises Apache: edit httpd.conf (or the vhost config), set `ServerTokens Prod` and `ServerSignature Off`, and add `Header unset X-Powered-By`.
4. For PHP version exposure: in php.ini (or via .htaccess on Apache with `php_flag expose_php Off`), set `expose_php = Off`.
5. Reload/restart Nginx or Apache: `sudo systemctl reload nginx` or `sudo systemctl reload apache2`.
6. Verify with browser DevTools or `curl -I https://yourstore.com` and confirm no version string is present in the Server header.

# Apache (httpd.conf or .htaccess)
ServerTokens Prod
ServerSignature Off
Header unset X-Powered-By

# Nginx (nginx.conf — inside http{} or server{} block)
server_tokens off;
# (requires headers_more module for full removal:)
more_clear_headers 'Server';
more_clear_headers 'X-Powered-By';

# PHP (php.ini)
expose_php = Off

# Next.js (next.config.js)
module.exports = { poweredByHeader: false }

What is server version?

Every time a visitor's browser (or a bot) loads a page on your store, your web server sends back a set of invisible "response headers." One of these is the `Server` header, and by default most web servers announce themselves with their exact name and version number — for example, `Server: Microsoft-IIS/10.0` or `Server: Apache/2.4.51`. A related header, `X-Powered-By`, can also reveal the scripting language or framework version (e.g., `X-Powered-By: PHP/8.1.2`). Together these are called "server version disclosure" or "banner grabbing." Neither header has any meaningful purpose for shoppers — they exist purely as leftover defaults.

Advertising your exact server software and version is like posting a sign on your shop door listing every lock brand and model you use. Automated attack tools (bots) continuously scan the internet for sites running specific software versions with known vulnerabilities. When your version is visible, your store becomes an easy target: attackers can instantly match your version against published vulnerability databases (CVE lists) and launch targeted exploits — without any guesswork. Suppressing these headers does not make your server invulnerable, but it removes you from the easiest tier of automated attack campaigns. It also demonstrates security hygiene to enterprise buyers and payment-card auditors (PCI DSS Requirement 2.2.7 addresses unnecessary information disclosure), reducing compliance friction.

See the complete Server version guide for every platform and the full background.