How to fix info disclosure server on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce (self-hosted or cloud) typically runs on nginx or Apache — the fix is made at the web-server configuration level on your server or in Adobe Commerce Cloud's configuration.
2. For *Adobe Commerce Cloud* (PaaS): edit the `.magento/routes.yaml` or the nginx configuration snippets in `.magento.app.yaml`. Under the `web > locations` section you can add custom headers. For suppressing `Server`, the most reliable approach is to add an upstream Fastly (the included CDN) custom VCL snippet to unset `beresp.http.Server` in `vcl_fetch`.
3. In the *Fastly admin* (within Adobe Commerce Cloud admin > Stores > Configuration > Advanced > System > Full Page Cache > Fastly Configuration): go to Custom VCL Snippets, add a new snippet of type `fetch` with content: `unset beresp.http.Server;`
4. For *self-hosted Magento on nginx*: SSH to the server, open `/etc/nginx/nginx.conf` or your Magento vhost file and add `server_tokens off;` inside the `http {}` or `server {}` block. Reload nginx: `sudo nginx -t && sudo systemctl reload nginx`.
5. For *self-hosted on Apache*: in your vhost config or `.htaccess` add `ServerTokens Prod` and `ServerSignature Off`. Restart Apache.
6. Verify with `curl -I https://yourdomain.com` — no version number should appear in the `Server` header.

What is info disclosure server?

Every time a visitor's browser (or a hacker's scanner) requests a page from your store, your web server sends back a collection of HTTP headers alongside the page content. One of these is the `Server` header — for example, `Server: nginx/1.25.5` or `Server: Apache/2.4.58 (Ubuntu)`. This header broadcasts exactly which server software you are running and, critically, which version. It is visible to anyone using a browser's developer tools, a command-line tool like `curl`, or an automated vulnerability scanner. Hiding or removing it takes only a small configuration change and immediately stops your server from volunteering this information.

Attackers routinely scan millions of websites, harvest version numbers from `Server` headers, and then look up known CVEs (publicly disclosed vulnerabilities) for that exact software version. If your server announces `nginx/1.25.5`, a malicious actor instantly knows which published exploits to try — no guesswork required. Removing the header does not make your server invulnerable, but it eliminates the easiest first step in a targeted attack, increasing the cost and effort for an adversary. This is classified under OWASP A05:2021 Security Misconfiguration — one of the most common causes of real-world breaches. Beyond security, some enterprise procurement and compliance processes (PCI-DSS, ISO 27001) explicitly flag verbose server banners as a finding that must be remediated before certification.

See the complete Info disclosure server guide for every platform and the full background.