How to fix info disclosure server on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Adobe Commerce is typically self-hosted or hosted on Adobe Commerce Cloud — you (or your DevOps team) control the server stack.
2. For nginx (most common): SSH into the server, edit `/etc/nginx/nginx.conf` or the Magento vhost config, add `server_tokens off;` inside the `http {}` or `server {}` block, then reload nginx: `sudo nginx -s reload`.
3. For Apache: edit the main `httpd.conf` or the vhost `.conf` file — add `ServerTokens Prod` and `ServerSignature Off`, then restart Apache: `sudo systemctl restart httpd`.
4. For Adobe Commerce Cloud (cloud.magento.com): add the header suppression in `.magento/routes.yaml` or via a Fastly custom VCL snippet in the Magento Admin → Stores → Configuration → Advanced → System → Full Page Cache → Fastly Configuration → Custom VCL Snippets, adding a `recv` or `deliver` snippet to unset `beresp.http.Server`.
5. Verify: `curl -I https://yourstore.com` — the `Server` header should be absent or show only a generic value with no version number.

## Apache (.htaccess or httpd.conf)
ServerTokens Prod
ServerSignature Off
Header unset Server

## nginx (nginx.conf — inside http{} or server{} block)
server_tokens off;

## IIS (web.config — inside <system.webServer>)
<security>
  <requestFiltering removeServerHeader="true" />
</security>

## Cloudflare Transform Rule (via dashboard UI)
# Rules → Transform Rules → Modify Response Header
# Operation: Remove
# Header name: server

What is info disclosure server?

Every time a browser (or a hacker's scanner) requests a page from your store, your web server sends back a response that often includes a `Server` header — a small piece of text that announces exactly what software is running, right down to the version number (e.g., `Microsoft-IIS/10.0`, `Apache/2.4.51`, or `nginx/1.18.0`). This is called information disclosure. Removing or blanking that header is a simple configuration change that stops your store from broadcasting its technology stack to anyone who looks.

Attackers routinely scan millions of sites looking for specific server versions with known security vulnerabilities — your `Server` header is a free map that tells them exactly which exploits to try. Exposing it significantly lowers the effort required to target your store, putting customer data, payment information, and your reputation at risk. OWASP lists this pattern under A05:2021 Security Misconfiguration, one of the most common causes of real-world breaches. Removing the header doesn't fix every vulnerability, but it removes the signpost that guides attackers to them, and it is expected by PCI DSS compliance auditors.

See the complete Info disclosure server guide for every platform and the full background.